The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from repository files (such as package.json, pyproject.toml, AGENTS.md, and CONTEXT.md) to discover project facts and commands, which creates a potential vector for malicious content to influence agent behavior.
Ingestion points: Instructions in SKILL.md and references/documentation-and-conventions.md direct the agent to read various project manifests, documentation, and CI configurations (e.g., package.json, go.mod, Makefile).
Boundary markers: There are no explicit boundary markers or "ignore instructions" wrappers defined for the data read from these external files.
Capability inventory: The skill is authorized to perform file system writes (creating and updating .md files) and execute shell commands such as git init and git rev-parse as described in references/git-policy.md.
Sanitization: The skill does not define any sanitization or validation routines for the content it ingests from the workspace files.

setup-project