The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill instructs the agent to read and process files, such as README.md and package.json, from the newly accessed project directory to understand the project stack. This exposes the agent to untrusted data that could potentially contain instructions intended to influence the agent's behavior.
Ingestion points: Target project files (README.md, package.json) and git status output referenced in SKILL.md.
Boundary markers: The instructions do not define specific delimiters or guidelines for the agent to distinguish between its instructions and the data found within the switched workspace.
Capability inventory: The skill utilizes workspace switching (move_agent_to_root), file system navigation (ls), and file reading capabilities.
Sanitization: There is no validation or sanitization process for the content of the external files before they are ingested into the agent's context.

switching-projects