The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill instructs the agent to ingest and act upon data from untrusted repository files, creating a potential attack surface.
Ingestion points: The skill reads project manifests and documentation including package.json, pyproject.toml, AGENTS.md, and .env (referenced in references/current-guidance.md).
Boundary markers: The instructions do not define specific delimiters or "ignore" blocks for the content of these files to prevent embedded instructions from influencing the agent.
Capability inventory: The discovered information (frameworks, scripts, and dependencies) is used to determine which shell commands the agent will execute or which additional skills it will load.
Sanitization: There are no explicit instructions to sanitize or escape the content read from these files before processing.
Mitigation: The skill includes positive security instructions, such as prohibiting the printing of secrets from environment files and requiring user approval before network-connected commands are run.

stack-discovery