The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill operates by reading and analyzing user-provided text files (.tex, .qmd, .md), which creates a potential surface for indirect prompt injection attacks.
Ingestion points: The skill uses the Read tool to ingest content from user-specified files or all document files within specific project directories (Slides/, Quarto/, root, master_supporting_docs/).
Boundary markers: The instructions do not specify the use of clear delimiters or instructions for the sub-agent to ignore embedded commands within the analyzed text.
Capability inventory: The skill is scoped to Read, Grep, Glob, Write, Agent, and Task tools. It is explicitly denied access to Edit and MultiEdit tools, ensuring it cannot modify the original source files. It also lacks network and shell execution capabilities.
Sanitization: The output is restricted to creating a new markdown report in a dedicated quality_reports/audits/ directory, which is noted as being gitignored, minimizing the risk of persistent or lateral impact from injected content.

humanize