The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from the codebase being investigated and from subagent reports, creating a surface for potential instruction injection.
Ingestion points: User input describing symptoms, teammate reports sent via SendMessage, and external project data (logs, code paths, and git history) read by investigators in Phase 2.
Boundary markers: The skill implements a 'Teammate Protocol' that explicitly instructs agents to rely on TaskGet for instructions rather than searching the filesystem, which serves as a structural defense against accidental obedience to injected code. However, no explicit delimiters or sanitization steps are defined for the Lead agent when processing incoming investigator reports.
Capability inventory: The skill utilizes TeamCreate, Task, and TaskUpdate for subagent management, and uses git status to monitor repository state. Subagents are expected to read files and logs to support their hypotheses.
Sanitization: No explicit sanitization, filtering, or escaping of codebase content or investigator findings is described before interpolation into the Lead agent's reasoning process.

competing-hypotheses