The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest significant amounts of external configuration and user-provided data to define its operating environment. While this creates a large attack surface where a user or an attacker-controlled file (like a schema or documentation URL) could attempt to inject instructions, the skill includes specific security best practices as boundary markers:
Sanitization/Normalization: It requires subjective rules to be reframed into "measurable forms" (e.g., changing "be careful with PII" to a specific logging constraint).
Human Review: It implements explicit confirmation steps (e.g., "obtain explicit user confirmation" before updating standards) and verification questions ("How would AI verify this rule passes?") to prevent accidental obedience to injected instructions.
Structured Ingestion: Data is categorized into strict axes and sections rather than being treated as raw unformatted text.
[DATA_EXFILTRATION]: While the skill mentions "Secret Stores," it explicitly mandates that agents should "capture only how to reach them" rather than the values themselves. It identifies environment variables, secret managers, and encrypted files as locations, which is standard development practice. There are no patterns suggesting the automated extraction of these secrets to external servers.
[COMMAND_EXECUTION]: The skill references various CLI commands (e.g., git status, terraform plan, npm install) as "Access methods" for external resources. These are documented as descriptive metadata for the agent to understand how to interact with the environment, not as hidden or obfuscated payloads designed to run silently.

project-context