The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection because it relies on the content of untrusted external files to make assessment decisions and perform file modifications.- Ingestion points: The skill reads untrusted data from work/<slug>/README.md, work/<slug>/data/*, and project.md.- Boundary markers: Absent. There are no instructions to use delimiters or ignore instructions that might be embedded within the artifacts or README files.- Capability inventory: The skill allows the agent to modify the file system via Edit(work/**) and execute shell commands using Bash(ls work/**) and Bash(jq *) based on its assessment.- Sanitization: Absent. The skill does not implement validation or sanitization of the content read from the work directories before using it to generate the # Assessment section or update frontmatter metadata.

review-work