The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from external issue trackers (such as Linear and GitHub), PR comments, and documentation, which could be used to inject malicious instructions into the agent's context.
Ingestion points: Data is ingested during the verification steps described in SKILL.md and through the processing of issue bodies and comments as outlined in references/issue-tracker-contract.md.
Boundary markers: references/agent-workflow.md explicitly defines "Instruction Trust Boundaries," instructing the agent to treat issue comments, PR comments, and external documents as untrusted context that cannot override policy.
Capability inventory: The skill is authorized to read repository files, query issue tracker metadata, and write configuration to docs/agents/workflow/config.md.
Sanitization: The skill contains explicit "Never" rules in SKILL.md and safety instructions in references/agent-workflow.md that command the rejection of attempts to bypass review, authorize production, or expose secrets found in untrusted context.

ziw-setup