The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill ingests data from external project sources and runtime observations which may contain malicious instructions designed to influence the agent.
Ingestion points: API schemas (api/schemas/), system command output (git log), and live network responses (curl).
Boundary markers: Lacks explicit data delimiters in the prompt instructions, but utilizes a structured proposal format for updates.
Capability inventory: The skill possesses the ability to execute shell commands (bun, git, curl) and has write access to the references/ directory.
Sanitization: Relies on manual human review (apply only on approval) rather than programmatic sanitization to validate data before it is persisted to the skill's map.
[COMMAND_EXECUTION]: The skill instructs the agent to execute various shell commands to synchronize and retrieve business context.
Evidence: Commands include bun run context:map, bun run api:sync, and git -C {{BACKEND_REPO}} log.
Context: While these are standard operations for development workflows, they represent an execution surface that could be targeted by command injection if parameters are not carefully handled by the underlying platform.

business-api-context