The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process external content from the repository and user communications, which presents a surface for indirect prompt injection attacks where malicious data could override agent instructions.
Ingestion points: The skill instructions direct the agent to read git status, AGENTS.md, codebase files, existing documentation, and user-provided materials as part of its 'Frontier Grill' process (detailed in SKILL.md and references/clarification-loop.md).
Boundary markers: There are no explicit instructions for the agent to use XML tags, delimiters, or other boundary markers to isolate untrusted data from the core system prompt.
Capability inventory: The skill has the capability to write new specification files to the docs/specs/ directory, update the project's CONTEXT.md glossary, and modify the work_index within the .harness/ directory if it exists.
Sanitization: The skill does not define any sanitization, filtering, or validation logic for the content it reads from the repository or user before including it in the reasoning context.

brainstorm