The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill suite defines procedures that require the agent to ingest and analyze external data, which creates a surface for indirect prompt injection where malicious instructions could be embedded in the analyzed content.
Ingestion points: Several sub-skills ingest untrusted data: context-audit/SKILL.md reads CLAUDE.md, AGENTS.md, and other skill definitions; reference-hunt/SKILL.md reads external code from repositories or websites; blindspot-pass/SKILL.md analyzes module history; and change-quiz/SKILL.md processes session diffs.
Boundary markers: The instructions do not prescribe the use of specific delimiters (e.g., XML tags or triple backticks) or explicit 'ignore instructions' warnings when processing this external content.
Capability inventory: The skills are instructional markdown files and do not contain executable scripts or subprocess calls. However, they are designed for agents that typically have file-system and terminal access.
Sanitization: There are no instructions for sanitizing, escaping, or filtering the content retrieved from external files or codebases before analysis.

finding-unknowns