The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from the local project environment, creating a surface for indirect prompt injection attacks.
Ingestion points: In SKILL.md, the agent is instructed to read CONTEXT.md, CONTEXT-MAP.md, and Architectural Decision Records (ADRs) within the docs/adr/ directory. It also cross-references information by reading the project's source code.
Boundary markers: The skill instructions do not provide specific delimiters or ignore-instructions for the data ingested from the project files.
Capability inventory: In SKILL.md, ADR-FORMAT.md, and CONTEXT-FORMAT.md, the skill is authorized to create and update Markdown files (CONTEXT.md and ADR files). It does not exhibit capabilities for network communication, subprocess spawning, or dynamic code evaluation.
Sanitization: No sanitization, validation, or escaping of the content read from the codebase is specified before the agent processes it or writes it back to documentation files.

domain-modeling