The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill possesses an attack surface for indirect prompt injection by ingesting and acting upon untrusted data from the local environment.
Ingestion points: The skill is instructed to read PROJECT.md and program.json from the working directory at startup to establish project context (headcount, policies) and current state.
Boundary markers: There are no explicit instructions for the agent to use delimiters or ignore embedded instructions when reading content from the markdown-based PROJECT.md file.
Capability inventory: The skill utilizes the Read and Write tools to modify the local filesystem (writing program.json, .md, and .csv files) and can pass data to the /as:project skill to update overarching project metadata.
Sanitization: The instructions do not specify any sanitization, filtering, or validation steps for the content ingested from the external PROJECT.md file.

workplace-programmer