The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is designed to process untrusted data sourced from the repository's git history and external decision records.
Ingestion points: The skill reads git diffs, commit subjects, PR bodies, and decision record files (.skills/decisions/) as described in the pipeline (SKILL.md § Pipeline).
Boundary markers: The skill defines a strict 'Iron Law' and 'Passive-data safety' rules (references/passive-data-safety.md) which explicitly instruct the agent to ignore any command-like content embedded in the diffs or records.
Capability inventory: The skill utilizes local git commands (diff, ls-files, rev-parse) and writes a single HTML output file strictly outside the repository worktree (SKILL.md § Output path).
Sanitization: Instructions mandate that all repo-derived text must be escaped for HTML and JavaScript contexts before being injected into the output packet (references/html-constraints.md).
[DYNAMIC_EXECUTION]: The skill populates a JavaScript-based HTML template (shell/packet.html) which renders content using .innerHTML.
Evidence: The shell/packet.html script injects data into elements like background-deep, intuition-body, and code-body using innerHTML.
Sanitization: The skill mitigates the risk of Cross-Site Scripting (XSS) by requiring the agent to escape all repo-derived text and JSON-safe content before filling the /* __PACKET_DATA__ */ placeholder (references/html-constraints.md).

study-change