The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill implements a synthesis workflow where data gathered from the codebase is interpolated into the prompts for explainer subagents. This creates a surface for indirect prompt injection if the analyzed codebase contains malicious instructions.
Ingestion points: Findings from explorer agents are passed via the {EXPLORER_FINDINGS_ALL} placeholder in references/explainer-prompt.md, and the user query is passed via {QUESTION}.
Boundary markers: The template uses markdown blockquotes and headers to delimit findings, but lacks explicit instructions to the LLM to ignore or sanitize embedded directives within the findings.
Capability inventory: The subagents have access to shell tools (rg, find, sed) and the ability to spawn further subagents.
Sanitization: No sanitization or filtering is performed on the findings before they are presented to the explainer agent.
[COMMAND_EXECUTION]: The explainer agent is directed to use shell commands such as rg (ripgrep), find, and sed to interact with the codebase. While these are used for architectural analysis, they represent a command execution capability within the skill's instructions.
[DATA_EXPOSURE]: The skill accesses the file ~/.config/pstack/pstack-models.md to retrieve model configuration and mapping information. Although this is part of the tool's internal logic, it involves reading from the user's home directory configuration area.

how