The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill presents a surface for indirect prompt injection by requiring the agent to ingest and analyze untrusted data from the local codebase.
Ingestion points: The workflow in SKILL.md directs the agent to gather context using grep_search and view_file on project files.
Boundary markers: Although output is restricted to Markdown artifacts, the skill lacks instructions for delimiters or treating read data as untrusted. The instruction to set RequestFeedback: false in the artifact metadata further reduces human-in-the-loop review.
Capability inventory: The agent is permitted to use grep_search, view_file, list_dir, and ask_question, with file creation limited to the artifacts directory.
Sanitization: No procedures are specified for escaping or validating the content retrieved from the codebase before it influences the agent's logic.

just-brainstorm