The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and analyze large volumes of untrusted data from external platforms (GitHub, Slack, Linear, Notion, Datadog, Sentry, and Databricks). This data frequently contains human-authored text (comments, messages, ticket descriptions) which could contain malicious instructions intended to influence the agent's behavior during synthesis.
Ingestion points: Multiple MCP tool calls defined in the source playbooks (e.g., gh pr view in code-archaeology.md, notion-fetch in notion.md, search_datadog_logs in datadog.md, and Slack search tools in slack.md).
Boundary markers: The prompt templates in references/investigator-prompt.md and references/synthesizer-prompt.md use blockquotes for user questions but do not utilize rigorous delimiters or sanitization for the content retrieved from external sources.
Capability inventory: The skill uses delegate_task to spawn sub-agents and has access to a wide range of MCP tools for data retrieval and system interaction (git, gh).
Sanitization: No explicit sanitization, filtering, or escaping is performed on the data retrieved from external sources before it is passed to the investigator and synthesizer agents.
[DYNAMIC_EXECUTION]: The skill dynamically generates prompts for sub-agents (investigators and synthesizers) using local templates and interpolated data.
Evidence: In SKILL.md, the skill reads the local file ~/.config/pstack/pstack-models.md to dynamically determine the target provider and model for each delegate_task call. This logic maps configuration strings to runtime execution parameters for the AI sub-agents.

why