The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from the .context/session/in/ directory and incorporates it into the agent's baseline context (CONTEXT-baseline-llm.md) or generates summaries. While the skill filters for sensitive filenames, it does not sanitize the contents of the files before inlining them, creating a surface where malicious instructions embedded in documents could influence the agent.
Ingestion points: The skill reads various file types (.md, .txt, .csv, .yaml, .json) from the .context/session/in/ directory as specified in Step 2 of the SKILL.md.
Boundary markers: The skill does not explicitly apply boundary markers or 'ignore' instructions around the inlined content in the generated baseline, relying instead on folder-based organization.
Capability inventory: The skill frontmatter lists read, write, bash, and task tools, which provide the agent with capabilities that could be targeted by an injection.
Sanitization: No content sanitization or escaping is performed on the data read from the input folder before it is written to the actionable snapshot or the baseline context file.

create-context