The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted content from the codebase and user-supplied questions without rigorous sanitization or instruction delimiters, creating a surface for indirect prompt injection.\n
Ingestion points: The agent ingests data through the {QUESTION} placeholder and via Read, Grep, and Glob tool outputs when scanning the local codebase.\n
Boundary markers: Findings are organized into markdown sections, but there are no explicit delimiters or system instructions to ignore potential commands embedded within the analyzed code.\n
Capability inventory: Subagents are restricted to readonly: true and use Read, Grep, and Glob tools; no write or network capabilities are exposed.\n
Sanitization: No input validation or content filtering is performed on the data retrieved from the files being analyzed.

ps-how