The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill facilitates session nesting through tools like run_thronglet, introducing an attack surface where untrusted data fetched from the repository or environment can influence sub-agent behavior.
Ingestion points: Untrusted file content and repository data are explicitly intended to be included in the prompt argument passed to sub-agents, as noted in the 'The prompt' section of SKILL.md.
Boundary markers: The instructions do not specify the use of delimiters (such as XML tags or triple backticks) or safety instructions to prevent the sub-agent from following commands embedded within the provided file content.
Capability inventory: Sub-agents possess significant capabilities, including the ability to edit files in the live directory (cwd) and commit changes, leading to potential repository modification if a sub-agent is compromised via injection.
Sanitization: There is no requirement or guidance in the skill for the primary agent to sanitize, escape, or validate the content of the data being passed to the sub-harness.

throng