The Agent Skills Directory

[PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection because it evaluates untrusted data (intent, plan, and execution artifacts) using AI prompts. Malicious content within these artifacts could attempt to influence the verification outcome or trigger unintended agent actions.
Ingestion points: Inputs defined as in:intent, in:plan, and in:execution in protocol.yon are directly interpolated into analysis tasks.
Boundary markers: The skill lacks explicit boundary markers or instructions to treat artifact content as untrusted data, increasing the risk that the AI might follow instructions embedded within the files.
Capability inventory: The workflow can trigger subsequent skills such as github-sync and instructs the agent to perform file system reads.
Sanitization: There is no evidence of sanitization, filtering, or validation of artifact content before evaluation.
[COMMAND_EXECUTION]: The instructions for Phase 4 ('Source re-check') explicitly direct the agent to execute shell commands, specifically git show <ref>:<path>, to verify the state of committed artifacts. While appropriate for a development tool, this represents a capability to perform file system operations based on the agent's internal evaluation logic.
[EXTERNAL_DOWNLOADS]: The protocol.yon file references an external documentation source at https://yon.younndai.com/yon-guide.txt. This is a static reference for documentation and does not involve automated execution of remote code.

verify