The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes user-supplied questions and codebase data to generate architectural explanations, creating a surface for indirect prompt injection.
Ingestion points: User input {QUESTION} is interpolated into subagent prompts in SKILL.md. Subagents read external files from the codebase via Read, Grep, and Glob tools in explorer-prompt.md, and the explainer subagent ingests synthesized findings in explainer-prompt.md.
Boundary markers: The templates in explorer-prompt.md and explainer-prompt.md use Markdown blockquotes and headers to separate instructions from data, but do not include explicit warnings to ignore instructions embedded in the codebase files.
Capability inventory: Subagents are explicitly restricted to read-only access in the SKILL.md spawn definitions. Tools available are limited to read and search functions (Read, Grep, and Glob). No file-write, network operations, or shell execution capabilities were detected across any of the scripts or templates.
Sanitization: There is no evidence of escaping, validation, or filtering of the content read from the codebase before it is passed to the synthesis stage in explainer-prompt.md.

how