The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill exhibits an indirect prompt injection attack surface as it processes external codebase content and user-provided text.
Ingestion points: The skill reads from repository files (F5 layer), internal documentation (e.g., docs/agents/project.md), and user-provided text anchors or code pastes.
Boundary markers: The skill implements strict structural requirements for every output turn, including a mandatory 'Announce' block (Subject/Layer/Kind) and 'Claim Hygiene' sections to separate facts from inferences.
Capability inventory: The skill is explicitly defined as 'Read-only', with prohibitions against writing tracked project state, making commits, or auto-invoking other skills, which significantly limits the potential impact of processed data.
Sanitization: Mandatory 'Claim Hygiene' requires the agent to verify source claims and label inferences, providing a conceptual filter for untrusted data processed during the teaching loop.
[SAFE]: The skill implements strong security boundaries and behavioral constraints through its 'Iron Laws'.
It explicitly forbids the agent from making product recommendations or ranking options, preventing the agent from being coerced into making decisions on behalf of the user.
It enforces a 'Read-only' policy for project files, ensuring the skill cannot be used to modify the codebase or persistence mechanisms.
The 'Authority Ladder' ensures that claims of 'standard' practices must be accompanied by specific tiers and sources, preventing the assertion of unverified or potentially malicious advice as established fact.

deepen-codebase