The Agent Skills Directory

[PROMPT_INJECTION]: The skill exhibits a surface for indirect prompt injection (Category 8) as it is designed to ingest and analyze untrusted external data.
Ingestion points: The skill reads several potentially user-controlled or attacker-controlled files during the 'Blast Radius Mapping' and 'Documentation Audit' phases, including implementation_plan.md, walkthrough.md, task.md, README.md, llms.txt, and SKILL.md files (as defined in Phase 1 and Phase 3 of SKILL.md and protocol.yon).
Boundary markers: There are no explicit instructions in the AI prompt templates (Steps 2-11 in protocol.yon) to treat the ingested file content as untrusted or to ignore embedded instructions.
Capability inventory: The skill's capabilities are limited to local file search and read operations (std:fs.search@v1) and AI text generation (std:ai.prompt@v1). It does not possess network access, arbitrary shell execution, or file-write capabilities beyond generating reports for the user.
Sanitization: No sanitization or escaping of the ingested file content is performed before it is interpolated into the analysis prompts.
Risk Assessment: Because the skill lacks high-privilege capabilities and requires user review for all outputs, the risk of instruction override via processed documentation is minimal and inherent to the skill's primary function.

insight-retro