The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: As the skill is designed to fetch and process external documentation and package sources, it naturally possesses an attack surface for indirect prompt injection from untrusted web content.
Ingestion points: Data enters the agent's context through the WebFetch, WebSearch, and search-docs tools, as well as by reading local package directories like vendor/ and node_modules/ in SKILL.md.
Boundary markers: The instructions do not provide specific delimiters or instructions to ignore potential commands embedded in the external content being researched.
Capability inventory: The skill is capable of performing network search and fetch operations and writing findings to the local file system (e.g., in .scratch/research/).
Sanitization: There are no mentions of sanitizing or escaping the content retrieved from primary sources before it is interpreted by the agent.
[DATA_EXFILTRATION]: The skill accesses local package directories to gather facts.
It is instructed to read vendor/ for Composer or node_modules/ for npm to investigate package sources and specifications.
This behavior is restricted to codebase metadata and is consistent with the skill's primary research purpose.
[COMMAND_EXECUTION]: The skill uses specific command-like strings for internal routing (e.g., /grill-me, /wayfinder, /to-spec).
These appear to be internal platform instructions for sub-agent coordination rather than shell commands.

research