The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill audits potentially untrusted data from external sources, creating a surface for indirect prompt injection.
Ingestion points: Processes untrusted content from GitHub issues, pull request reviews, CI logs, and arbitrary file/web content as part of the audit process.
Boundary markers: Includes a dedicated "Retrieved Evidence Boundary" section in SKILL.md that instructs the agent to treat external content as data, not authority.
Capability inventory: Capable of reading and writing files in the .tigerkit/ directory and executing local git commands.
Sanitization: Relies on instructional constraints to prevent the agent from following instructions embedded in audited data.
[COMMAND_EXECUTION]: The skill executes shell commands for repository management and artifact handling.
Evidence: Executes git ls-files and git check-ignore to verify exclusion rules before writing artifacts, as documented in references/artifact-paths.md.
Evidence: References and executes a package-local script scripts/durable_artifacts.py for managing artifact storage locations and status checks.

tk-audit