The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from multiple external sources, creating a significant attack surface for indirect prompt injection.\n
Ingestion points: The skill reads data from Git commits and PRs (code-archaeology.md), Linear tickets and comments (linear.md), Notion documents and meeting notes (notion.md), Slack chat threads (slack.md), Datadog logs and incidents (datadog.md), Sentry error events and comments (sentry.md), and Databricks analytics tables (databricks.md).\n
Boundary markers: While the investigator-prompt.md and synthesizer-prompt.md templates define a "careful, cautious investigator" persona and include instructions to "surface evidence and describe it accurately," they lack explicit delimiters or "ignore embedded instructions" warnings for the content being processed.\n
Capability inventory: The agent utilizes git and gh CLI tools for repository operations. It also interacts with various MCP servers to perform read operations, search metadata, and execute read-only SQL queries (execute_sql_read_only in databricks.md).\n
Sanitization: No explicit sanitization, escaping, or filtering of the ingested external content is defined in the instructions or sub-agent prompts.\n- [COMMAND_EXECUTION]: The skill utilizes the git and gh command-line interfaces to extract historical code context and pull pull-request metadata (SKILL.md Step 2).\n- [EXTERNAL_DOWNLOADS]: The skill integrates with multiple well-known and trusted external services via MCP, including GitHub, Linear, Notion, Slack, Datadog, Sentry, and Databricks, to retrieve historical records and runtime telemetry. These interactions are documented as part of the skill's intended research functionality.

why