The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill explicitly instructs the agent to ingest and prioritize instructions from external files within the project environment, which could allow malicious repository content to influence agent behavior.
Ingestion points: Instructions in SKILL.md mandate reading from .ai-factory/skill-context/aif-best-practices/SKILL.md and .ai-factory/ARCHITECTURE.md if they exist.
Boundary markers: No delimiters or explicit "ignore embedded instructions" warnings are provided; instead, the skill states that "the skill-context rule wins" in cases of conflict, giving external data precedence over the skill's primary instructions.
Capability inventory: The skill is permitted to use Read, Glob, and Grep tools and is involved in generating code, performing reviews, and refactoring logic.
Sanitization: The skill lacks any instructions to validate or escape the content retrieved from these external files before processing them as instructions.

aif-best-practices