The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted content from the user's codebase during exploration and critique phases. While this creates a potential surface for indirect prompt injection, the risk is mitigated by the execution environment.
Ingestion points: Codebase files are ingested via Glob, Grep, and Read operations in SKILL.md and referenced prompt templates.
Boundary markers: The prompt templates (explorer-prompt.md, explainer-prompt.md) do not explicitly use unique delimiters to separate ingested code from instructions.
Capability inventory: All subagents are restricted to readonly: true as defined in SKILL.md, limiting capabilities to information gathering and synthesis.
Sanitization: There is no explicit sanitization or filtering of the ingested code content.
[COMMAND_EXECUTION]: The skill utilizes standard search and read tools (Glob, Grep, Read) to analyze the codebase. These are appropriate for the skill's stated purpose of architectural exploration and are used in a read-only context.

how