The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection because it ingests untrusted data from the conversation history and local files to generate its output. * Ingestion points: The skill scans the active conversation for domain concepts and reads the existing UBIQUITOUS_LANGUAGE.md file during re-runs (specified in SKILL.md). * Boundary markers: There are no explicit delimiters or system instructions used to distinguish between user data and instructions or to prevent the agent from following commands embedded in the domain terms. * Capability inventory: The skill has the ability to write to the local filesystem (UBIQUITOUS_LANGUAGE.md). It does not have access to tools for network communication, shell execution, or privilege escalation. * Sanitization: There is no evidence of sanitization, escaping, or schema validation for the data extracted from the conversation before it is written to the markdown file.

ubiquitous-language