The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: As a code analysis tool, the skill naturally ingests untrusted source code, which represents an indirect prompt injection surface.
Ingestion points: Data enters the agent context through tools like get_file, get_ast, get_symbols, and run_query in SKILL.md.
Boundary markers: The instructions do not define specific delimiters or warnings to separate processed code content from agent instructions.
Capability inventory: The skill has the capability to read any file within a registered project path and execute complex structural queries.
Sanitization: There is no evidence of content sanitization or instruction filtering for the ingested code data.

tree-sitter