The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process large amounts of untrusted external data (books, transcripts, podcasts) to create new executable instructions.
Ingestion points: SKILL.md (Stage 0) and methodology/02-stage1-parallel-extract.md specify reading external content such as PDFs, EPUBS, and transcripts supplied by the user or fetched from paths.
Boundary markers: The methodology uses the RIA++ framework to structure extraction, but there is no explicit instruction for the sub-agents to ignore or escape system-level command patterns that might be embedded within the source text.
Capability inventory: The skill performs file system operations including reading files and writing new skills to the agent's configuration directories (~/.claude/skills/ or .cursor/skills/) as described in methodology/07-stage5-deliver.md.
Sanitization: The process includes a 'Triple Verification' phase (Stage 1.5) and multiple human-in-the-loop confirmation checkpoints (Stages 0, 1.5, and 5) which serve to mitigate, but not entirely eliminate, the risk of malicious instructions persisting through the distillation process.

longform-skill-distiller