The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes large volumes of untrusted text from external sources such as PR comments, Slack messages, ticket descriptions, and logs, then interpolates them into prompts for investigator and synthesizer agents. This creates a surface for indirect prompt injection where malicious content in a PR or Slack thread could attempt to influence the agent's reasoning.
Ingestion points: The skill pulls data from Git logs and blame, PR bodies and comments via gh, Linear tickets/comments, Notion document content, Slack thread history, Sentry error events, and Databricks SQL query results.
Boundary markers: The prompt templates in references/investigator-prompt.md and references/synthesizer-prompt.md do not appear to use explicit data delimiters or boundary markers to isolate the ingested external data from the agent's instructions.
Capability inventory: The delegated investigator agents have access to a wide range of MCP tools for data retrieval across the organization's infrastructure. However, the instructions across all files strictly mandate a "read-only" posture ("Inspect only, no writes").
Sanitization: There is no evidence of sanitization or filtering of the ingested external content before it is processed by the LLM.
[DATA_EXFILTRATION]: The skill is designed to aggregate and synthesize sensitive organizational data, including source code history, internal documentation, private team communications, and infrastructure telemetry. This behavior is consistent with the primary purpose of a design rationale and archaeology tool. The data is processed within the configured agent environment and delegated to designated models, with no evidence of exfiltration to unauthorized external endpoints.

why