The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The protocol defines a workflow for processing untrusted data, including user inputs and external references, creating an inherent attack surface for indirect prompt injection.
Ingestion points: As described in SKILL.md and references/protocol.md, the agent is instructed to read 'raw inputs', 'user inputs', and 'external references'.
Boundary markers: The protocol implements strict boundary markers by requiring specific sections (Source, Assumption, Plan, Action, Verification, Report) and quoting exact paths/line numbers.
Capability inventory: The agent is authorized to perform file edits and execute verification commands (Test-Path, Select-String, git diff, and general test/lint commands).
Sanitization: No specific sanitization or escaping mechanisms for external content are defined in the protocol templates.
[COMMAND_EXECUTION]: The skill instructs agents to execute shell commands for the purpose of verifying their work and the state of the filesystem.
Evidence: references/protocol.md details the use of standard utility commands such as Test-Path, Select-String, and git diff, as well as environment-specific testing and linting tools. These operations are limited to the local environment and intended for verification.

lcs-chain-of-truth