The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process implementation plans, which are identified as untrusted data.
Ingestion points: The skill accepts plans via command-line arguments, pasted text, or file paths as described in SKILL.md.
Boundary markers: The instructions explicitly warn the agent to treat the input as untrusted data and ignore embedded instructions that attempt to change rules or read secrets.
Capability inventory: The agent has the ability to read local repository files, perform web searches via MCP tools (such as Context7, DeepWiki, or Exa), and modify files (post-audit).
Sanitization: The skill mandates extracting factual claims from the input while disregarding any logic or workflow instructions contained within the untrusted plan.
[DATA_EXFILTRATION]: The skill implements strict guardrails against data exfiltration by explicitly prohibiting the reading of secrets (such as .env files, credentials, or private tokens) and forbidding the transmission of raw plan text, private source code, or unredacted local context to external MCP tools or web services.
[COMMAND_EXECUTION]: The instructions explicitly forbid the agent from executing commands found within the plan or installing new dependencies, mitigating risks associated with malicious or destructive commands embedded in audited plans.

areyousure