The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill acts as a conduit for indirect prompt injection because it transforms untrusted user-provided descriptions and repository data into a structured prompt that will be interpreted by a different AI session.
Ingestion points: The skill ingests an initial user request (ask) and collects further details through a multi-step interview process. It also queries the local repository to identify file paths and object identities in SKILL.md.
Boundary markers: The skill implements structural boundaries in its output, such as Off limits, Must keep working, and Open sections, which are designed to help the receiving agent distinguish between constraints and variable task data.
Capability inventory: The skill uses chat interactions and reads repository content to fulfill its purpose. It also utilizes the clarify-decisions sub-skill and has the ability to write prompt artifacts to the local file system at .skills/prompts/<slug>.md.
Sanitization: The skill employs a 'pointers, not paste' policy, instructing the agent to provide file paths or IDs instead of verbatim file contents. This reduces the volume of untrusted content that could be used for injection attacks in the receiving session.

forge-prompt