The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill facilitates the ingestion of untrusted data from multiple external sources, including real-time chat (Slack), project management tickets (Linear), and long-form documentation (Notion), which represents a significant attack surface for indirect prompt injection. A subagent tasked with reading this data 'fully' and 'gathering evidence' could inadvertently execute instructions embedded within those historical records by an attacker (e.g., in a public channel or shared document). While the skill includes a structured synthesis process and emphasizes factual reporting, it lacks explicit boundary markers or sanitization logic to isolate external data from the agent's control flow.
Ingestion points: Data is pulled from Linear issues/comments, Notion document bodies, Slack threads, Sentry stack traces, and Git commit history/PR review comments.
Capability inventory: The skill spawns multiple subagents with tool access (MCP servers) and utilizes the synthesizer subagent to verify citations by reading the local codebase and calling MCP tools.
Boundary markers: Absent. The investigator-prompt.md template uses standard markdown headers to structure the task but does not employ specific delimiters or 'ignore embedded instructions' warnings when presenting external content to the subagent.
Sanitization: Absent. The investigator is instructed to capture verbatim quotes for the synthesizer, with no filtering or escaping of the ingested text.

why