The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill acts as a collector for historical data from various enterprise platforms, which introduces a surface for indirect prompt injection if those sources contain malicious payloads designed to manipulate AI behavior.
Ingestion points: Evidence is gathered from commit messages, PR bodies and comments, Linear/Jira tickets, Notion/Confluence documents, Slack/Discord chat threads, Datadog/Sentry logs, and Databricks SQL query results.
Boundary markers: The skill lacks explicit delimiters or boundary markers to distinguish between the agent's internal instructions and the potentially untrusted evidence retrieved from external platforms.
Capability inventory: The skill utilizes shell commands (git, gh, rg) and various MCP tools to search and fetch data. It also leverages subagents to synthesize findings, which could be targeted by instructions embedded in the historical record.
Sanitization: The instructions require the investigator agents to 'Quote verbatim' and provide no mechanisms for sanitizing or escaping the data before it is presented to the synthesizer agent.
[COMMAND_EXECUTION]: The skill relies on local shell command execution to perform its primary function of code archaeology.
Evidence: SKILL.md and references/sources/code-archaeology.md define the use of git blame, git log, git show, and gh pr view to extract implementation-time rationale. While these are standard developer tools, they are used to process and display metadata from the repository history.

why