The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill defines patterns for delegating tasks to a subagent using the task tool, which inherently possesses an indirect prompt injection surface.
Ingestion points: The prompt parameter within the task tool call in SKILL.md is used to provide detailed instructions and data to the subagent.
Boundary markers: There are no instructions or examples demonstrating the use of markers or delimiters to separate trusted developer instructions from potentially untrusted data processed by the subagent.
Capability inventory: The skill provides examples of the subagent performing codebase searches and reading files (e.g., docs/api.md), indicating that the subagent has file system access capabilities that could be exploited by injected instructions.
Sanitization: The skill does not describe or recommend any validation, filtering, or sanitization of the content before it is interpolated into the subagent's prompt.

thrifty