The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill aggregates and processes data from a wide array of external, potentially untrusted sources, creating a surface for indirect prompt injection attacks.
Ingestion points: The skill is designed to fetch content from Slack conversations (references/sources/slack.md), Notion documents (references/sources/notion.md), Linear/Jira tickets (references/sources/linear.md), Sentry error logs (references/sources/sentry.md), Databricks analytics (references/sources/databricks.md), and GitHub PR comments via the gh tool.
Boundary markers: The investigator prompts in references/investigator-prompt.md rely on instructions to "Quote, don't paraphrase," but the skill lacks explicit boundary delimiters (such as XML tags or unique markers) or "ignore embedded instructions" warnings when processing the retrieved external text.
Capability inventory: The skill uses git and gh CLI tools for repository analysis and various MCP (Model Context Protocol) connectors to read from external service APIs. The skill instructions mandate read-only access for its subagents.
Sanitization: There is no evidence of explicit sanitization, filtering, or escaping of the retrieved external content before it is passed to the synthesizer agent for processing.
[COMMAND_EXECUTION]: The skill executes local shell commands to establish historical context from the git repository.
Evidence: SKILL.md contains templates for executing git blame, git log, and gh pr view to extract metadata and discussion from the source control system.

why