The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill ingests data from various external platforms including GitHub PRs, Slack conversations, Linear tickets, and Notion documents. This creates a surface for indirect prompt injection, where malicious instructions hidden in these sources could potentially influence the subagents' investigation or the final synthesis.
Ingestion points: Subagents ingest data from gh pr view output, Slack messages, Linear ticket comments, Notion page bodies, Sentry error logs, and Datadog traces.
Boundary markers: The skill uses template interpolation (e.g., {ALL_INVESTIGATOR_FINDINGS}) but lacks explicit delimiters or specific instructions to treat the ingested data as untrusted.
Capability inventory: The skill uses git, gh, and ripgrep for local analysis, and leverages various MCP tools to read data from external services. The instructions explicitly state that investigators should only read data and not perform write operations.
Sanitization: No explicit sanitization or filtering of content from external sources is performed before it is processed by the LLM.

why