The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and synthesize data from diverse external sources including issue trackers (Linear), long-form documents (Notion), real-time chat (Slack), and PR comments. These sources are considered untrusted as their content can be influenced by third parties. The skill lacks explicit boundary markers or instructions to ignore embedded prompts within the retrieved data, creating a surface for indirect prompt injection that could influence the agent's synthesis or subsequent investigative steps.\n
Ingestion points: Ingestion of historical context from multiple sources occurs via the investigator subagents defined in references/sources/linear.md, references/sources/notion.md, references/sources/slack.md, and references/sources/code-archaeology.md (via gh pr view).\n
Boundary markers: The prompt templates for subagents (references/investigator-prompt.md) and the synthesizer (references/synthesizer-prompt.md) do not include delimiters or specific instructions to treat external data as untrusted or to ignore instructions found within the evidence.\n
Capability inventory: The skill orchestrates multiple subagents with tool access, executes local shell commands (git, gh, rg), and utilizes a variety of MCP read and search capabilities.\n
Sanitization: Content is passed directly to investigators and then to a synthesizer without any filtering or sanitization of potential injection strings.

why