The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill's primary function is to ingest untrusted data from a target repository (through its discovery waves) and synthesize it into new instruction files (AGENTS.md, CLAUDE.md, etc.). This creates a vector where malicious instructions hidden in the codebase could be incorporated into the agent's new configuration.
Ingestion points: The agent reads repository files during 'Wave 1' and 'Wave 2' discovery phases, and the scripts/audit-agents-md.sh script scans the filesystem for instruction surfaces.
Boundary markers: The skill includes instructions in references/discovery-prompts.md to 'Separate documented facts from inference' and 'Read only enough repo evidence to support claims,' which serves as a basic delimiter for untrusted content.
Capability inventory: The skill can write files to the local filesystem using scripts/scaffold-agents-md.sh with the --write flag and creates symlinks via shell commands (ln -s).
Sanitization: The skill relies on structured templates (references/project-templates.md) and a 'WHAT / WHY / HOW' filter to format output, but it lacks explicit sanitization or escaping of the ingested repository text before interpolation.
[COMMAND_EXECUTION]: The skill executes local shell scripts and standard Unix utilities to perform its auditing and scaffolding tasks.
Evidence: scripts/audit-agents-md.sh uses find, wc, sed, and grep to analyze the repo. scripts/scaffold-agents-md.sh uses cat and mv to generate files. SKILL.md also instructs the agent to use ln -s for symlink creation.

init-agent-config