The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and act upon durable project knowledge stored in Markdown files within the repository, which creates an attack surface for indirect prompt injection if an attacker can commit files to the repository.
Ingestion points: The agent reads index.md files and individual Markdown concept files within the docs/knowledge/ directory or other bundle roots identified by the okf_version marker (SKILL.md).
Boundary markers: The skill relies on specific YAML frontmatter structures and okf_version markers to distinguish knowledge from other content, providing some structure to the data ingestion.
Capability inventory: The skill allows the agent to create and update files, search repository history, and modify agent instruction files (AGENTS.md, CLAUDE.md).
Sanitization: The skill includes an 'Instructions fence' to separate facts from standing orders and a verification step (Invariant 7) to ensure frontmatter parses correctly; however, it lacks explicit sanitization for the free-text body content of the concepts against embedded instructions.
[PERSISTENCE]: The skill instructs the agent to modify repository-level agent instruction files to ensure the knowledge base is utilized in future sessions.
Evidence: The 'Workflows' section in SKILL.md directs the agent to 'add one line to the repo's agent instruction file naming the location' of the bundle and instructing future agents to load the skill and perform capture reviews.

okf-project-knowledge-base