The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process large volumes of data from external, potentially untrusted sources such as Git commit messages, issue tracker descriptions, team chat logs, and shared documents. An attacker with the ability to contribute to these sources could embed malicious instructions (indirect prompt injection) to bias the investigation or influence the agent's final synthesis.
Ingestion points: Untrusted data enters the agent context through git log and git blame output, ticket descriptions/comments fetched via APIs, team chat threads from messaging platforms, and internal documentation files.
Boundary markers: While the skill uses structured templates like the Investigator prompt and Synthesizer prompt, it lacks explicit instructions or delimiters to isolate ingested text from the agent's control flow or to ignore embedded instructions within that data.
Capability inventory: The skill utilizes shell commands (git) and interacts with runtime-provided connectors for databases, APIs, and document systems.
Sanitization: There is no evidence of sanitization, filtering, or escaping of the ingested external content before it is processed by the LLM.
[COMMAND_EXECUTION]: The skill uses local shell commands to build a "code anchor" for the investigation.
Evidence: Execution of git blame, git log, and git show in SKILL.md and references/sources/source-control.md to retrieve file history and commit details. These are read-only operations intended for repository analysis.

why