The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill facilitates the ingestion of data from external sources and local raw files to update a research database, which introduces an attack surface for indirect prompt injection.
Ingestion points: The skill explicitly instructs the agent to perform "official-source discovery" and read evidence from the ../raw layer.
Boundary markers: While user arguments are wrapped in <task> tags, the skill does not specify rigorous delimiters or isolation for content retrieved from external sources or raw evidence files.
Capability inventory: The skill allows the agent to read and write markdown files within the docs/research/ directory, including indices, logs, and summary pages.
Sanitization: The skill mitigates risk by requiring the agent to classify evidence gaps and contradictions (e.g., using dispositions like evidence gap or contradiction gap) rather than treating all ingested content as authoritative fact.

research-wiki