The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process a wide variety of untrusted external data, creating a significant attack surface for indirect prompt injection.
Ingestion points: The skill reads data from PR bodies and comments (via gh), issue tracker content (documented in linear.md), long-form documentation (documented in notion.md), team chat history (documented in slack.md), and production error logs (documented in sentry.md and datadog.md).
Boundary markers: The prompt templates provided for subagents (references/investigator-prompt.md and references/synthesizer-prompt.md) do not utilize explicit boundary markers or delimiters when interpolating data from these external sources to prevent the agent from following instructions embedded in the data.
Capability inventory: The skill possesses the capability to execute shell commands (via git and gh), run SQL queries (via Databricks MCP), and perform broad searches across documentation and chat platforms.
Sanitization: There is no evidence of sanitization, filtering, or escaping of the ingested content. The instructions in references/investigator-prompt.md explicitly tell the agent to "Quote verbatim" and "Read the whole thing," which may increase the risk of the agent obeying malicious instructions hidden within legitimate-looking data.

cursor-why