The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes content from local files to populate the agent's session context, creating a surface for indirect prompt injection if those files are compromised.
Ingestion points: The skill reads the 'ChDR' index from docs/adlc/memory/chdr.md and legacy fallback .adlc/memory/chdr.md, as well as individual draft files in .adlc/drafts/chdr/.
Boundary markers: The instructions do not specify the use of delimiters or 'ignore' instructions for the content extracted from these files.
Capability inventory: The skill involves reading local files, searching directory structures (including finding workspace roots via .gitmodules), and writing draft files to the local filesystem.
Sanitization: There is no evidence of sanitization or filtering applied to the rationale text or metadata read from the project files before they are rendered into the session context.

change-boot