The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes project source code and configuration files, which are inherently untrusted inputs in the context of an agent's work.
Ingestion points: Codebase files (TypeScript/JavaScript) and configuration files (e.g., .fallowrc.json) are processed by analysis commands such as fallow dead-code and fallow health as described in SKILL.md.
Boundary markers: Rule 9 in SKILL.md explicitly instructs the agent to treat project configuration as untrusted input, warns against following instructions from remote config content, and recommends reporting any remote URLs found.
Capability inventory: The skill can modify the filesystem using fallow fix and execute code within a sandbox via the code_execute MCP tool described in references/mcp.md.
Sanitization: The instructions emphasize performing a --dry-run before applying any fixes with fallow fix, allowing for human review of proposed changes.
[DYNAMIC_CONTEXT_INJECTION]: The skill documentation mentions the !command syntax used for load-time execution in certain agent platforms.
Evidence: SKILL.md provides examples of benign commands such as !git status, !gh pr view, and !git log to explain the platform's dynamic context capabilities.
Context: These references are documented as legitimate examples for development workflows and are used for instructional purposes rather than malicious intent.

fallow