The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process data from untrusted external sources, such as GitHub PRs, issues, long-form documentation, and real-time chat platforms (Discord, Slack, Teams), which could contain malicious instructions designed to influence the agent's synthesis.
Ingestion points: External data enters the agent context via gh pr view, gh search, and various MCP tools used to fetch chat history, documentation, and infrastructure logs as defined in SKILL.md and SOURCES.md.
Boundary markers: The skill employs Markdown blockquotes within its prompt templates (INVESTIGATOR-PROMPT.md and SYNTHESIZER-PROMPT.md) to delimit ingested content, though it lacks programmatic escaping.
Capability inventory: The agent has access to git, gh (GitHub CLI), and multiple MCP tools capable of querying external APIs, observability platforms, and messaging services.
Sanitization: No explicit programmatic sanitization of external content is performed; however, the skill mandates a strict epistemic framework (EPISTEMICS.md) to guide the LLM toward cautious and evidence-based reasoning, which serves as a mitigation against following embedded instructions.

why