The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill's primary function involves ingesting and acting upon untrusted data from the repository and external sources, which creates a surface for indirect prompt injection.
Ingestion points: The playbooks instructions require the agent to read repository files, pull request content, external research results, and project instructions (playbooks/investigation.md, playbooks/review.md, references/review-execution.md).
Boundary markers: There are no explicit instructions to wrap ingested external content in XML tags or other delimiters, nor are there specific warnings to the model to ignore embedded instructions within that data.
Capability inventory: The skill maintains high-privilege capabilities including file modification (playbooks/feature.md, playbooks/bug-fix.md), network operations via the research tool, and arbitrary command execution through the debug and test tool integrations.
Sanitization: No sanitization, escaping, or validation logic is specified for data retrieved from external sources before it is processed by the agent.

kriscard-mode