The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and analyze user-provided "prose prompts" to determine if they should be converted into structured DSPy signatures. This represents an attack surface for indirect prompt injection.
Ingestion points: SKILL.md (Section 3, Step 1) and intermediate/operation_candidates.json (OP-2) require the agent to read and process arbitrary prompt strings provided by the user.
Boundary markers: The instructions do not define specific delimiters or boundary markers (e.g., XML tags, specific wrappers) to be used when the agent processes the untrusted prose prompts to prevent them from being interpreted as instructions.
Capability inventory: The skill does not include any capabilities for executing commands, writing files, or performing network operations. It is restricted to providing logical design advice.
Sanitization: No sanitization or validation rules for the input prose prompts are provided within the skill logic.
[DATA_EXPOSURE]: The skill documentation (README.md and references/R1-source-evidence.md) mentions local absolute file paths (e.g., /Users/5imp1ex/Desktop/Skill-Workplace/output/dspy-sop-skill/SKILL.md). While this exposes information about the developer's local filesystem structure, it appears to be used solely for source attribution and does not involve the exfiltration of sensitive system credentials or user data.

agentsop-signature-design