The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is designed to fetch and interpret "original publications" from the internet using WebSearch and WebFetch. This creates a vulnerability surface for indirect prompt injection if retrieved web content contains malicious instructions intended to manipulate the agent's behavior.
Ingestion points: External content retrieved from websites via WebFetch (referenced in SKILL.md).
Boundary markers: The skill does not define specific delimiters or "ignore instructions" wrappers for the data it ingests from the web.
Capability inventory: The skill has access to Read, Grep, WebSearch, and WebFetch tools.
Sanitization: No sanitization or validation of the retrieved web content is specified before the model processes it.
[EXTERNAL_DOWNLOADS]: The skill allows for the dynamic retrieval of external documentation. While its stated purpose is to fetch architectural standards and publications, there is no integrity checking or source verification for these downloads, which could lead to the ingestion of malicious content.
[DATA_EXPOSURE]: The host-contract.json file explicitly lists sensitive project records, such as INVOICES.csv, agreement/, TIME.csv, and TASKS.csv, as being within the skill's context. Although SKILL.md provides negative constraints (e.g., "do not use for... agreement-scope"), the skill technically possesses the capability to access these sensitive files via the Read tool.

architecture-knowledge