The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from project files (README.md, CONTEXT.md, and source code) which could serve as a vector for indirect prompt injection if the repository content is malicious.
Ingestion points: The skill reads from root CONTEXT.md, CONTEXT-MAP.md, docs/lore/README.md, and general project source code (type and model names).
Boundary markers: The instructions do not specify explicit delimiters or "ignore instructions" warnings when processing the contents of these repository files.
Capability inventory: The skill has the capability to read project files and write changes to docs/lore/glossary.md and CONTEXT.md.
Sanitization: A significant mitigation is present in the "Guardrail" section, which mandates that every entry must be confirmed by the user before it is written, providing a human-in-the-loop safety check.

lore-ul