The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill facilitates the injection of untrusted user data (UI annotations) into the agent's prompt via platform-specific hooks described in the installation instructions.
Ingestion points: Ingestion occurs via the UserPromptSubmit hook for Claude Code and the AfterAgent hook for Gemini CLI defined in SKILL.md. These hooks fetch external data from a local server.
Boundary markers: Present. The skill uses clear delimiters such as === AGENTATION: {c} UI annotations === and === END === to wrap the injected content.
Capability inventory: The skill allows the agent to use Read, Write, Bash, Grep, and Glob tools, providing a wide surface for potential misuse if the injected instructions are obeyed.
Sanitization: Absent. The Python processing script in the hook directly prints the comment field from the retrieved JSON data without any escaping or validation logic.
[COMMAND_EXECUTION]: The integration instructions recommend configuring hooks that execute shell commands involving piping network data from localhost to a Python interpreter (curl ... | python3 -c). While this is used for localized data processing rather than remote script execution, the pattern of piping network-sourced data to an interpreter involves inherent risks if the local service is compromised.

agentation