The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from codebase files during the auditing phase, which creates a potential surface for indirect prompt injection.
Ingestion points: The skill reads file structures, imports, patterns, and configuration files from the local codebase in SKILL.md (Challenger Mode).
Boundary markers: There are no explicit instructions or delimiters defined to isolate the codebase content from the agent's core instructions.
Capability inventory: The skill has permissions to write to .agents/PROJECT_CONTEXT.md and .agents/TECHNICAL_DEBT.md.
Sanitization: No sanitization or filtering of external file content is performed.
Mitigation: The risk is mitigated by a mandatory human-in-the-loop protocol requiring the agent to present findings individually and wait for user triage before applying any modifications.
[SAFE]: The skill does not perform network operations, request elevated privileges, or include obfuscated code. Its activities are strictly scoped to the .agents/ directory and reading the local project structure.

refine-project-context