The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill determines the target repository for file operations by ingesting data from external sources such as issues, pull requests, and planning documents.
Ingestion points: Artifacts such as the primary issue, PR, plan doc, or wayfinder map being analyzed (SKILL.md).
Boundary markers: The skill requires an explicit confirmation step: "Announce the resolution before the first question... and treat it as a confirmation point — proceed only if the human doesn't contradict it." (SKILL.md).
Capability inventory: The agent performs codebase exploration, fact-lookup, and writes documentation (CONTEXT.md, ADRs) to the resolved target repository (SKILL.md).
Sanitization: No specific sanitization or delimiters are defined for the input signals beyond the human review checkpoint.
[DATA_EXFILTRATION]: The skill facilitates access to file system paths outside the current working directory, specifically targeting developer code directories to resolve repository clones.
Evidence: Instructions allow the agent to look for local clones in "known checkout roots (~/dev/code/<repo>)" when resolving the target repo (SKILL.md).

domain-modeling