The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted input data to generate insurance plan narratives, creating a surface for injection attacks.
Ingestion points: The customer, gap_analysis, and product_plans objects provided via manual entry (HTML forms), skill linkage, or JSON file imports.
Boundary markers: The prompt template in templates/plan_sections.md uses bracketed headers to separate data blocks but lacks explicit instructions for the model to ignore embedded commands within those blocks.
Capability inventory: The skill possesses the capability to write Word documents to the local file system using lib/generate_plan.py and invoke MCP tools for product information.
Sanitization: While scripts/validate_input.py performs basic type and presence validation, there is no evidence of sanitization to remove or escape prompt injection sequences from the user-provided text.
[METADATA_POISONING]: The TEST.md documentation file contains hardcoded absolute file paths from the developer's local workstation.
Evidence: The file references paths such as /Users/zhangjia/Documents/客户/保险/技能/保险技能/, which reveals the internal directory structure and the username of the developer environment.

insurance-agent-plan-generator