The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill analyzes untrusted local source code, which serves as a potential indirect prompt injection surface.
Ingestion points: Codebase content is read using Glob, Grep, and Read tools as part of the exploration and critique workflows defined in SKILL.md and references/explorer-prompt.md.
Boundary markers: Content is passed between subagents via templates (e.g., {EXPLORER_FINDINGS_ALL}, {FILE_PATHS}), providing structural separation from instructions.
Capability inventory: The execution environment for all spawned subagents is limited by the readonly: true setting in SKILL.md, preventing them from performing write operations or system modifications regardless of input instructions.
Sanitization: No specialized escaping or content sanitization is applied to the source code before it is processed by the explorer or critic models.

how