The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes data from the local filesystem to resume and maintain session state, creating a surface for potential injection if the workspace contains untrusted content.
Ingestion points: The agent reads the _mindmap.yaml state file and various markdown documents (e.g., _index.md, analysis.md, ideas.md, and session logs) from the docs/brainstorms/deep/ directory tree.
Boundary markers: The instructions do not define explicit delimiters or 'ignore' instructions for the content read from these state files before it is incorporated into the prompt context.
Capability inventory: The skill has permissions to read and write to the filesystem and can invoke subagents such as web-search-researcher for external information retrieval.
Sanitization: There is no evidence of schema validation or sanitization for the markdown or YAML content before it is processed by the agent to resume a session.

deep-brainstorm