The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from local repository files during its analysis and implementation phases. This creates a potential surface for indirect prompt injection if the project files contain malicious instructions designed to override the agent's behavior.
Ingestion points: The skill reads project source code across specified paths/modules to create an "intent map" and perform refactoring.
Boundary markers: No specific boundary markers or "ignore" instructions for embedded content in the target files are defined in the SKILL.md or prompt templates.
Capability inventory: The skill utilizes file-reading for analysis, file-writing for refactoring implementation, and shell command execution for validation checks.
Sanitization: The instructions do not explicitly mandate sanitization or escaping of content retrieved from the target codebase before it is incorporated into sub-agent prompts.
[COMMAND_EXECUTION]: The skill includes a workflow for running validation gates and packet-level checks. As shown in references/work-packet-template.md, this involves executing arbitrary shell commands such as npm run test or npm run typecheck. While necessary for the skill's function, this capability could be exploited if an attacker can influence the commands defined in a work packet.

orchestrate-batch-refactor