The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill facilitates the processing of data from potentially untrusted project files and external sources.
Ingestion points: The skill reads content from CLAUDE.md (Step 0b), markdown files within a designated _agent-inbox/ directory (Step 5b), and fetches information from GitHub issues and pull requests using the gh command-line tool (Step 5c).
Boundary markers: There are no explicit delimiters or specific instructions for the agent to treat content from these files as untrusted data or to ignore embedded instructions.
Capability inventory: The skill has the ability to execute shell commands (Step 1), perform git operations (Step 3), and interact with GitHub repositories.
Sanitization: A mitigation is present in Step 5b.5, where the agent is explicitly instructed "Do not auto-execute" pending items from the inbox and to let the user decide whether to process them.
[COMMAND_EXECUTION]: The skill contains logic to extract and run shell commands directly based on documentation in the CLAUDE.md file.
Evidence: Step 1 ("If CLAUDE.md documents a sync or pull command (rsync, git pull, etc.), run it now") creates a path for command execution based on the contents of a file that may be modified by third parties in a shared repository or via Pull Requests. This relies on the agent's interpretation of what constitutes a 'sync' command.

start-session