The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill facilitates the ingestion and processing of untrusted external data, which creates a surface for indirect prompt injection attacks.
Ingestion points: In the critique and audit routes (detailed in references/critique.md and references/audit.md), the agent is instructed to read source code, audit implementations at specific file lines, and inspect rendered output from external URLs.
Boundary markers: The instructions do not include explicit boundary markers or "ignore embedded instructions" warnings for the agent when it is processing external source code or web content. There is no directive to treat this data strictly as content to be analyzed rather than instructions to be followed.
Capability inventory: The skill possesses significant system capabilities, including the ability to write or modify files (Route A: new, Route D: polish, and various refinement playbooks in references/focused-playbooks.md) and the ability to delegate tasks to browser subagents for technical audits.
Sanitization: There are no requirements for sanitizing or escaping the content of external files or web pages before they are interpolated into the agent's context or used to inform code-writing actions.

get-design