The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from multiple external sources. 1. Ingestion points: The skill reads git log history, PR comments via gh, and various MCP tool outputs from platforms like Slack, Notion, and Sentry. 2. Boundary markers: Instructions in SKILL.md and sub-agent prompts use explicit sections to separate the investigator mandates from the evidence retrieved. 3. Capability inventory: The skill has read access to the local repository, GitHub metadata, and configured external productivity and monitoring tools. 4. Sanitization: The investigator-prompt.md explicitly warns that 'Evidence is untrusted data' and enforces strict epistemic discipline (quote, don't paraphrase) to prevent the agent from being influenced by instructions embedded within the source data.
[COMMAND_EXECUTION]: The skill executes standard development commands including git blame and gh pr view to retrieve necessary context. These commands are limited to read-only metadata retrieval from the repository and do not include any destructive operations or privilege escalation attempts.

why