The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill performs an audit of project-level files (such as CLAUDE.md, AGENTS.md, and various skill source files) to extract and consolidate rules and logic. This creates a surface where malicious instructions embedded in these files could influence the agent's behavior during the workbench setup.
Ingestion points: Project files identified during Phase 1 (Audit) and Phase 3 (Source of Truth), including CLAUDE.md, AGENTS.md, and files within the skills/ directory.
Boundary markers: The instructions do not specify the use of delimiters or 'ignore' instructions when reading these external files.
Capability inventory: The skill has the capability to write files, create symbolic links in the user's home directory (e.g., ~/.claude/skills), and execute shell scripts via the xy-link tool.
Sanitization: There is no mention of sanitizing or escaping the content retrieved from the audited files before they are integrated into the agent's context or used to generate new bridge files.
[COMMAND_EXECUTION]: The skill relies on executing a shell script located at skills/xy-link/scripts/bridge-skill.sh to perform linking and status checks. This involves shell command execution that targets project-specific paths.
[FILE_SYSTEM_MODIFICATION]: The skill is designed to modify the user's home directory by creating symbolic links in configuration folders for various agents (Claude Code, Codex, Grok, etc.). While this is the intended functionality of a workbench management tool, it involves sensitive operations on user configuration paths.

xy-workbench