The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill presents a surface for indirect prompt injection as it is designed to ingest and act upon untrusted content from the environment.
Ingestion points: The skill reads plan.md, codebase diffs, and evidence files using Read and Grep tools.
Boundary markers: No explicit delimiters or guardrail instructions are provided to distinguish between reviewer instructions and untrusted data in the reviewed files.
Capability inventory: The agent can execute Read, Grep, and Bash commands based on its analysis of the ingested data.
Sanitization: The skill lacks logic to sanitize or filter potential injection strings from the external content it processes.

critical