The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill operates by ingesting and analyzing untrusted content from a repository, creating a surface for indirect prompt injection attacks.
Ingestion points: The agent reads repository source code, test files, context files (CONTEXT.md), and architecture records (docs/adr/) using the Read and Glob tools. It also ingests output from the git log command via Bash.
Boundary markers: The instructions do not define specific delimiters or instructions to ignore embedded commands when the agent or its subagents process the content of the analyzed files.
Capability inventory: The skill has access to tools for writing files (Write), executing shell commands (Bash), and dispatching additional agents (Agent), which could be leveraged if an injection attack successfully influences the agent's behavior.
Sanitization: There are no explicit requirements for the agent to sanitize or escape data read from the repository before processing it or incorporating it into the final proposal artifact.

refactorkit