The Agent Skills Directory

[PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection through its document and code analysis pipeline.
Ingestion points: The scripts/gather_context.py script reads user-specified documentation, source code, and test files from the local filesystem to create a context bundle for the agent.
Boundary markers: The script uses standard markdown code blocks to wrap the ingested documentation and code content, but it does not provide explicit security delimiters or 'ignore embedded instructions' warnings to the agent.
Capability inventory: The agent is given capabilities to read project files and is instructed to judge and potentially fix documentation, allowing injected instructions in the documentation to influence the agent's behavior.
Sanitization: The ingested text is bundled raw into the agent's context without any filtering, escaping, or validation of the content.

verifying-claims