The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process data from a wide variety of sources including GitHub PR comments, Slack messages, Notion documents, and issue tracker descriptions. This provides a surface for indirect prompt injection, where an attacker could place malicious instructions in these sources that the agent might execute during an investigation. \n- Ingestion Points: git log output, gh pr view output (comments and reviews), and MCP tools for Slack, Notion, Linear, Datadog, Sentry, and Databricks as defined in SKILL.md and the references/sources/ directory. \n- Boundary Markers: The prompt templates in references/investigator-prompt.md and references/synthesizer-prompt.md use markdown headers to organize information but do not include explicit data delimiters or instructions to ignore commands within the evidence. \n- Capability Inventory: The skill can execute shell commands via bash and spawns subagents with tool access enabled (readonly: false). \n- Sanitization: No explicit sanitization or filtering of retrieved content is performed before processing. \n- [COMMAND_EXECUTION]: The skill executes git and gh shell commands using variables like file paths, line numbers, and commit hashes derived from the user's input and repository state. While necessary for the skill's purpose, this represents a potential command injection surface if the agent processes malicious metadata or filenames.

why