The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes potentially untrusted data from the user and from document files provided as context.
Ingestion points: User questions and the recap document content (specified by the --context flag) are processed and interpolated into LLM prompts as defined in references/qa-prompt.md.
Boundary markers: Prompt templates include structural headers (## Recap Context, ## Question) to separate system instructions from user-provided content.
Capability inventory: The skill utilizes Read, Grep, Glob, and Bash tools to verify citations and explore the project state (documented in Phase 3 of SKILL.md).
Sanitization: Stringent path boundary checks are applied to the context file and any lazy-fetched code files to ensure they remain within the repository root or allowed temporary directories. Additionally, all synthesized responses are processed through a mandatory redaction script (scripts/security-redact.js) to prevent secret leakage.
[SAFE]: The skill implements proactive security controls that significantly mitigate common agent risks. These include the use of realpath-based path validation, a restricted file-read allowlist derived from document evidence, and the requirement for corpus completeness (scan_error check) before processing data.

recap-ask