The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill ingests content from the local repository (manifests, READMEs, and code files) to generate or audit documentation, creating a potential surface for indirect prompt injection.
Ingestion points: In modes/init.md, the skill reads project manifests (package.json, pyproject.toml, etc.), README files, and entry points. In modes/audit.md, it reads all repository files changed since the last domain-model commit.
Boundary markers: The instructions do not explicitly require the use of delimiters or "ignore" warnings when interpolating the ingested content into the prompt.
Capability inventory: The skill has access to Write, Edit, and restricted Bash tools, which could be misused if an injection successfully influences the agent.
Sanitization: No sanitization, escaping, or filtering of the ingested file content is mentioned in the instructions.
Mitigation: The skill implements a mandatory consent-gate for every write operation as defined in SKILL.md, ensuring the user reviews and approves all proposed changes before they are applied to the filesystem.
[COMMAND_EXECUTION]: The skill executes restricted shell commands to perform repository audits.
Evidence: modes/audit.md executes git log -1 --format='%H %cs' -- CONTEXT.md CONTEXT-MAP.md to find the last update and git log --name-only --format= <sha>..HEAD to identify changed files.
Context: These operations are limited to the git log command as specified in the allowed-tools configuration in the SKILL.md frontmatter, preventing arbitrary command execution.

domainkit