The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from multiple external sources, including GitHub PR descriptions, Slack chat messages, Notion documents, Linear tickets, Sentry error logs, and Databricks telemetry. An attacker could embed malicious instructions in these sources to influence the agent's behavior or the synthesizer's output.
Ingestion points: Data is ingested from git, gh, and various MCP servers for Linear, Notion, Slack, Datadog, Sentry, and Databricks SQL.
Boundary markers: The skill instructs investigators to "Quote verbatim" to ensure accuracy, but the synthesizer prompt template does not specify structural delimiters (like XML tags or clear markers) to isolate this untrusted content from the rest of the prompt instructions.
Capability inventory: The skill uses git, gh, rg, and multiple read-only MCP tools. The instructions for the synthesizer role explicitly state: "Do not write files, commit, or modify external state."
Sanitization: The instructions do not include explicit sanitization, filtering, or escaping of the external content before it is interpolated into the prompts for synthesis.
[COMMAND_EXECUTION]: The skill executes local shell commands including git log, git blame, git show, gh pr view, and rg to perform historical code analysis. These commands are standard development tools and are employed consistently with the skill's primary purpose.
[EXTERNAL_DOWNLOADS]: The skill interacts with well-known third-party services including Slack, Notion, Linear, Datadog, Sentry, and Databricks. These interactions occur via MCP (Model Context Protocol) servers to retrieve historical evidence required for the investigation.

why