The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from the local repository, including source code comments and configuration files, to generate project rules and documentation. This creates a surface where an attacker can embed malicious instructions in the codebase that the agent may interpret as commands or include in the generated knowledge base.
Ingestion points: The skill reads all project files, configuration files (e.g., .eslintrc, pyproject.toml), and specifically searches for comments containing keywords like 'DO NOT', 'NEVER', 'ALWAYS', and 'DEPRECATED' (SKILL.md, Phase 1).
Boundary markers: None identified; the skill does not use delimiters or instructions to ignore embedded commands within the files it analyzes.
Capability inventory: The skill spawns parallel sub-agents (Task calls), executes shell commands (find, awk, wc), and writes AGENTS.md files to the filesystem.
Sanitization: The skill does not perform sanitization, validation, or escaping of the content read from the files before incorporating it into its analysis or output.
[COMMAND_EXECUTION]: The skill executes multiple shell commands to perform project structural analysis.
Evidence: The workflow includes bash scripts using find, awk, wc, sed, sort, and uniq to measure project scale and file concentration (SKILL.md, Phase 1 and 2). While these are standard tools, they operate on the user's filesystem context.

index-knowledge