The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from external files which serves as a potential surface for indirect prompt injection.
Ingestion points: The skill reads files from the llmwiki/raw/ directory as its primary input.
Boundary markers: The instructions do not specify any boundary markers or delimiters to separate the source content from the agent's instructions, nor are there explicit rules to ignore instructions embedded in the raw files.
Capability inventory: The skill is granted read access to the raw/ directory and write access to the wiki/ directory structure, including concepts/, entities/, sources/, and draft/, as well as the index and log files. It explicitly lacks network access.
Sanitization: No sanitization, validation, or filtering mechanisms are defined for the content extracted from the source files before it is used to generate or update wiki pages.

ingest