The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted content by interpolating user queries and codebase findings into subagent prompts, creating a surface for indirect prompt injection.
Ingestion points: The {QUESTION}, {EXPLORATION_ANGLE}, and {EXPLORER_FINDINGS_ALL} placeholders in SKILL.md and the prompt templates in the references/ directory.
Boundary markers: The templates in references/explainer-prompt.md and references/explorer-prompt.md use markdown headers and blockquotes to delimit external data from instructions.
Capability inventory: Subagents use read-only codebase analysis tools including Read, Grep, and Glob (referenced in references/explainer-prompt.md).
Sanitization: Security is enforced at the platform level via the readonly: true flag specified for every Agent spawn in SKILL.md, which prevents malicious payloads from performing write operations, modifications, or network exfiltration.
[SAFE]: The skill utilizes local configuration files (plugins/pstack/models.json) and project-specific override sheets (pstack-models.md) to manage model selection and reasoning efforts, following standard development practices without introducing external risks.

how