The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill provides an attack surface for indirect prompt injection because it reads, searches, and lists the content of Markdown files (ADR-NNN-*.md) from a user-configurable directory. If these files contain malicious instructions, an agent processing them could be influenced to take unintended actions.
Ingestion points: The scripts/decision_log.py script reads the entire text of decision record files via the read_text and load_decisions functions to perform searches and metadata extraction.
Boundary markers: The skill does not implement explicit delimiters or boundary markers (such as XML tags or unique separators) or provide instructions to the agent to disregard natural language commands found within the records.
Capability inventory: The skill allows for local file creation and updates (path.write_text) and directory creation (mkdir). It does not possess network access, high-privilege system access, or remote code execution capabilities.
Sanitization: There is no evidence of sanitization, filtering, or escaping of the content read from the ADR files before it is returned to the agent's context.

decision-log