The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from a repository's source files, documentation, and configuration files to generate an AGENTS.md file that defines instructions for AI agents. An attacker with write access to the repository could attempt to embed malicious instructions in files like README.md or source code comments, hoping they are promoted to the generated file's CRITICAL section.
Ingestion points: The skill explicitly reads README.md, package.json, build configuration files, environment templates, and source code during its analysis phase (SKILL.md Steps 0, 1, 2, and 4).
Boundary markers: The instructions direct the agent to separate its analysis from the final output, but it lacks explicit delimiters for untrusted data during interpolation. It relies on agent reasoning to distinguish metadata from instructions.
Capability inventory: The skill allows the agent to read repository files, perform search operations (glob, grep), and write new configuration files (AGENTS.md, CLAUDE.md).
Sanitization: The skill contains strict rules to skip binary files, avoid reading secret-bearing files (e.g., .env), and strip HTML comments, while requiring human approval before any files are written.

writing-agents-md