The Agent Skills Directory

Indirect Prompt Injection Surface: The skill is designed to read, analyze, and explain source code, prompt-engineering artifacts, and other project documents which could contain embedded malicious instructions.
Ingestion points: Target files are ingested from the workspace based on user input or search tool results (as described in SKILL.md and references/walkthrough.md).
Boundary markers: The instructions specify that content should be rendered as visible chat text, but do not provide explicit delimiters or warnings to ignore instructions found within the code being analyzed.
Capability inventory: The skill utilizes file reading, workspace searching, subagent dispatching, and file writing to the .copilot-tracking directory.
Sanitization: No explicit sanitization or escaping of the target file content is mentioned before it is processed by the AI.
File System and Tracking Logic: The skill creates a "decisions-and-changes ledger" inside a .copilot-tracking directory at runtime when user decisions are made.
This mechanism maintains a history of the walkthrough but is explicitly restricted from modifying production source files unless requested by the user, which follows least-privilege principles.
The instructions emphasize keeping tracking references out of production code, documentation, and commit messages to prevent metadata leakage or environment pollution.
Automated Subagent Delegation: The skill allows for the dispatch of subagents (specifically referencing Claude Haiku 5.5 (copilot)) to perform heavy tracing work.
This pattern involves dynamic context delegation to another model instance. The skill mitigates risks by requiring the agent to treat subagent outputs as "leads to confirm" via direct file reads rather than taking them as absolute truth.

rpi-walkthrough