The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill's primary function is to ingest and analyze external, untrusted work artifacts (such as code files, plans, and logs), which creates a surface for indirect prompt injection attacks where malicious instructions hidden in the artifacts could influence the agent's behavior.
Ingestion points: Work artifacts, objectives, and constraints identified during the initialization step in both SKILL.md and protocol.yon.
Boundary markers: The instructions attempt to scope reviewers by briefing them with narrow lenses and directing them to "review only the supplied artifacts," but they lack explicit technical delimiters or strong negative constraints to ignore natural language instructions found within the data being analyzed.
Capability inventory: The skill can spawn multiple subagents (reviewer agents), synthesize aggregate reports, and suggest self-modifications to its own protocol (which are gated by user approval).
Sanitization: There is no evidence of content sanitization, filtering, or escaping of the text within the reviewed artifacts before it is processed by the reviewer agents.

cold-review