The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill identified a potential ingestion surface by reading external project files, tickets, and other skill definitions which could contain malicious content. However, the skill is constrained by instructions to only provide advice and is explicitly prohibited from invoking other tools or skills. * Ingestion points: Reads AGENTS.md, project documents, ticket statuses, code state, and SKILL.md files of other candidate skills. * Boundary markers: Instructions explicitly state 'Return advice; never start the recommended stage' and 'Do not invoke it.' * Capability inventory: Limited to reading files and providing text recommendations; disable-model-invocation is set to true in frontmatter. * Sanitization: None observed for external data processing.

ask-workflow