The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill's primary function is to process project context and code to generate documentation, which inherently presents an attack surface for indirect prompt injection via malicious data in the source files.
Ingestion points: The agent ingests project source code, architectural details, and user-provided descriptions across several files (SKILL.md, AGENTS.md, etc.).
Boundary markers: While the skill provides structured templates and Markdown best practices, it does not explicitly define strict delimiters for isolating untrusted data during processing.
Capability inventory: The skill utilizes capabilities to read files from the workspace and write Markdown files to the documentation directory.
Sanitization: The instructions contain robust safety rules that mandate the redaction of credentials, API keys, internal IP addresses, and tokens, effectively mitigating common data exfiltration risks associated with documentation generation.
[SAFE]: The skill provides a local validation script (scripts/validate_skill.py) that uses safe parsing methods (yaml.safe_load) to perform static analysis of the skill's structure without executing untrusted code or making network requests.
[SAFE]: The instructions include clear warnings regarding destructive commands (e.g., DROP TABLE, rm -rf) in runbook templates, requiring practitioners to include safety warnings and verification steps.
[SAFE]: Documentation patterns for API docs and AI agent context files follow established industry standards (OpenAPI, AGENTS.md) and emphasize concise, actionable context rather than arbitrary code execution.

technical-documentation