The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is designed to read and process external data from local files, which could potentially contain malicious instructions intended to influence the agent's behavior.
Ingestion points: The skill attempts to read a file named DESIGN.md from the current project directory in SKILL.md (Step 2) and also processes arbitrary user-provided text for enhancement.
Boundary markers: While the skill formats the ingested content into a specific "DESIGN SYSTEM (REQUIRED)" block, it lacks explicit instructions to the agent to treat the data as untrusted or to ignore any embedded directives within the file content.
Capability inventory: The skill is granted Read and Write tool permissions, allowing it to access file contents and create new files (e.g., next-prompt.md) based on the processed (and potentially poisoned) input.
Sanitization: There is no evidence of sanitization, validation, or filtering of the content retrieved from DESIGN.md before it is interpolated into the final prompt output.

enhance-prompt