The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill's primary function is to read and execute a plan from an external markdown file, creating a surface where untrusted data can control the agent's actions.
Ingestion points: The skill reads the # Instructions section from work/<slug>/README.md in Step 2 of its procedure.
Boundary markers: The skill lacks boundary markers or instructions to disregard malicious content. Instead, the documentation explicitly states that the instructions are the "contract" and that the agent should follow them "rather than redesigning" them, which discourages the agent from questioning malicious input.
Capability inventory: The skill allows for arbitrary command execution via Bash(*), file system modifications through Write(work/**) and Edit(work/**), and the invocation of external skills (asta-tools:*, asta-preview:*).
Sanitization: No sanitization or validation is performed on the instructions retrieved from the README file before they are executed step-by-step.

do-work