The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection due to its core function of reading and acting upon untrusted local project files.
Ingestion points: The audit workflow in SKILL.md (Step 1 and Step 2) involves scanning project indicators and files using Glob, Grep, and Read tools.
Boundary markers: The instructions do not specify any boundary markers or special handling (such as 'ignore instructions within files') to prevent the agent from accidentally executing commands embedded in source code or documentation.
Capability inventory: The agent is granted capabilities to modify files via the Edit tool and execute specific filesystem operations (git mv, mkdir -p) through the Bash tool, which could be misused if the agent follows instructions found within scanned files.
Sanitization: There is no indication that the skill sanitizes or filters the content of the project files it reads before evaluating them against the structural rules.

project-structure