The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill facilitates a workflow where the agent discovers and processes instructions from untrusted repository files. * Ingestion points: As described in references/chatgpt-work.md, references/claude-code.md, and references/codex.md, the agent is instructed to read AGENTS.md, .agents/manifest.json, and repository-hosted skill files. * Boundary markers: There are no instructions to use specific delimiters or delimiters with warnings to ignore embedded adversarial commands within the data being read. * Capability inventory: The skill manages the execution of highly privileged tools including file system modification, shell command execution, and GitHub API operations for pull requests and issues. * Sanitization: The instructions do not define any sanitization, validation, or filtering for the content ingested from the external repository files before it enters the agent's context.

harness-operations