The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and synthesize information from multiple external, potentially attacker-controlled sources, creating a surface for indirect prompt injection.
Ingestion points: The skill retrieves data from numerous external environments including GitHub PRs (via gh), Linear tickets, Notion documentation, Slack conversations, Sentry error logs, and Databricks analytics tables. These sources often contain user-generated content that could include malicious instructions.
Boundary markers: The prompt templates located in references/investigator-prompt.md and references/synthesizer-prompt.md interpolate variables such as {ALL_INVESTIGATOR_FINDINGS}, {TICKET_IDS}, and {COMMIT_LIST} into the instruction block. There are no explicit technical delimiters or sanitization patterns defined to isolate these inputs or prevent the model from obeying embedded instructions.
Capability inventory: The skill explicitly configures its sub-agent "investigators" with readonly: false (agent mode). While intended to ensure access to MCP tools, this provides the sub-agents with the privilege level necessary to execute actions or modify state if they are successfully influenced by malicious data within the ingested sources.
Sanitization: There is no evidence of sanitization, filtering, or validation of the text retrieved from external sources before it is passed to the reasoning agents.

why