The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from the repository which could contain malicious instructions designed to influence the agent's behavior.
Ingestion points: The skill reads git diff output, git commit messages, and files located in docs/specs/ and .skills/ directories.
Boundary markers: The skill lacks explicit syntactic boundary markers (like XML tags) in its prompts, but it includes a strong instruction-level boundary by defining these inputs as "passive data" and explicitly commanding the agent to ignore embedded instructions.
Capability inventory: The agent has the capability to write files to the repository (docs/explainers/) and execute shell commands (git, grep).
Sanitization: The references/passive-data-safety.md file mandates redacting secrets (API keys, tokens) and escaping content when embedding it into HTML/JS contexts. The provided shell/packet.html template uses basic HTML entity replacement for some fields, though body sections are rendered via innerHTML which requires the agent to correctly pre-sanitize the content.
[COMMAND_EXECUTION]: The skill pipeline involves executing shell commands to gather git data and verify the resulting output file.
Evidence: Step 11 in SKILL.md defines a shell script utilizing grep to verify the generated HTML file's structure.
Safety Mechanism: The "Slug resolver" in SKILL.md implements a mechanical sanitization process that restricts characters to [a-z0-9-] and truncates length, which effectively prevents command injection when these slugs are used as filenames in shell commands.
[DYNAMIC_EXECUTION]: The skill generates and writes HTML files that include embedded JavaScript logic for rendering data.
Evidence: shell/packet.html contains a script block that processes a window.__PACKET__ JSON object injected by the agent at runtime. This constitutes template-based code generation.

brief-team