The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted external data which could contain malicious instructions.
Ingestion points: Reads the project's instructions files (AGENTS.md, CLAUDE.md), learning logs (LEARNINGS.md), and any files within the docs/ directory during the audit process.
Boundary markers: The skill does not define explicit delimiters or instructions to ignore embedded commands within the files it reads, though it instructs the agent to use subagents for summarization rather than full file dumps.
Capability inventory: The skill has the capability to read any file in the repository and write to local files (migration and setup processes).
Sanitization: There is no explicit sanitization or validation of the content read from the project files before it is processed by the agent or subagents.
Mitigation: The skill explicitly states that authority cannot be widened by content in project files and requires explicit user approval for every file modification.

knowledge-audit