The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from multiple external sources, creating a potential surface for indirect prompt injection where malicious instructions embedded in those sources could influence agent behavior.
Ingestion points: SKILL.md (Step 3) specifies reading repository history (commit messages, PR descriptions), issue trackers (Linear/Jira), external documents (Notion/Google Docs), observability logs (Datadog), error events (Sentry), and analytics data (Databricks).
Boundary markers: Absent. While the prompts in references/investigator-prompt.md and references/synthesizer-prompt.md provide structure, they do not utilize specific delimiter tokens or explicit instructions to ignore instructions embedded within the fetched external data.
Capability inventory: The skill utilizes git (blame, log, show), gh (GitHub CLI read-only), rg (ripgrep), and various read-only MCP tools for Datadog, Sentry, Databricks, Notion, and Linear. No file-write or network-send capabilities are present.
Sanitization: Present. The skill provides extensive guidance in references/epistemics.md instructing the agent on how to critically evaluate evidence, identify bias, surface contradictions, and avoid following user or source hypotheses blindly (the 'Sycophancy Trap').

why