The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data (the output being reviewed) by interpolating it directly into the prompts of quality review agents, creating a surface for indirect prompt injection attacks.
Ingestion points: The REVIEWER_PROMPT in SKILL.md interpolates the {output} variable (the deliverable under review) and the {task_spec} directly into the reviewer's system instructions.
Boundary markers: The prompt utilizes markdown headers (e.g., ## Output Under Review) to separate sections, but it lacks robust delimiters or explicit instructions to the agent to disregard any control sequences or adversarial instructions contained within the {output}.
Capability inventory: The skill spawns subagents using the Agent tool and describes a fix_agent that performs modifications based on flags generated from the untrusted output.
Sanitization: No evidence of sanitization, escaping, or validation of the {output} or {task_spec} variables is provided before they are processed by the LLM.

santa-method