The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest data from diverse and potentially untrusted external sources to reconstruct work context, which could contain malicious instructions designed to manipulate the agent.
Ingestion points: The skill reads data from t3_thread_read (chat history) and utilizes the why skill to gather information from source control, issue trackers, chat/issue channels, documentation, and error tracking services.
Capability inventory: The agent possesses capabilities to execute git and gh commands and can orchestrate other agents using delegate_task.
Boundary markers: The instructions do not specify the use of clear delimiters or markers (e.g., XML tags or specific markdown headers) to separate untrusted external content from the agent's internal reasoning or instructions.
Sanitization: While the skill explicitly instructs the agent to 'sanitize private context before any public output,' it does not provide specific technical mechanisms for sanitizing or escaping the untrusted data it processes before passing it to the model.

recall