The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and analyze untrusted external data in the form of project source code, test suites, and commit history, creating a surface for indirect instructions.
Ingestion points: In SKILL.md, the agent is instructed to read the "complete test and production owner," "entry point, callers, callees," "CI routing," and "relevant history." In CAMPAIGN.md, the agent must read "every assigned test in full, including parameter tables."
Boundary markers: The instructions do not define clear delimiters or "ignore embedded instructions" warnings for the agent when it processes the content of these files.
Capability inventory: The skill has significant capabilities, including file deletion ("Delete obsolete test-only exports, globals, wrappers, and dead production paths"), source code modification, and command execution via the repository's test runner ("Run the smallest owner and sibling tests").
Sanitization: There is no evidence of sanitization or filtering of the external content (e.g., code comments or test strings) before it is processed by the agent's logic.

audit-test