The Agent Skills Directory

[PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection because it ingests untrusted data from an external codebase and flows it into the prompts of multiple downstream agents.
Ingestion points: Codebase metadata (modules, dependencies, hotspots) extracted from the filesystem in the scan_repo step (SKILL.md).
Boundary markers: The skill uses simple triple-dash (---) separators and XML-like tags to delimit scan data, but lacks explicit instructions for the LLM to ignore potentially malicious instructions embedded within the codebase content.
Capability inventory: The skill has the ability to read filesystem structure (via history-explorer), write various file types to the workspace (.puml, .drawio, .docx), and persist data to long-term storage (via memory).
Sanitization: While user_message is escaped and truncated, the architectural summary extracted from the codebase is interpolated into rendering tasks without visible sanitization or filtering.
[COMMAND_EXECUTION]: The skill accepts a target filesystem path directly from user input (user_message) to initiate a scan. This introduces a risk where a user could potentially target sensitive directories (e.g., configuration or credential folders) if the underlying history-explorer skill does not implement strict path validation or scoping.

meta-diagram-triangulation