The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted metadata from repository files and reflects it into a central index file (INDEX.md) that the agent is explicitly instructed to trust. Additionally, the AGENTS.md snippet establishes a control-flow convention where common characters like a single period ('.') are interpreted as a command to proceed, creating a surface for triggering actions via untrusted content.
Ingestion points: The fast-track-ai-index.sh script parses frontmatter metadata (e.g., owner, status, captured) from files within the fast-track-ai/ subdirectories (tracks, refs, research, etc.).
Boundary markers: Absent. The generated INDEX.md markdown tables contain metadata values without delimiters, escaping, or warnings to the agent that the content is derived from potentially untrusted sources.
Capability inventory: The agent can execute local shell scripts (fast-track-ai-init.sh, fast-track-ai-index.sh), perform file system operations (creation, modification, deletion), and chain other workflow skills based on the contents of the fast-track-ai/ tree.
Sanitization: None. The field() function in the indexing script extracts raw values from frontmatter and prints them directly into the generated markdown tables, allowing for the injection of instructions or misleading status information.

ft-init