The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill instructions direct the agent to automatically ingest data from files such as .agents/product-marketing.md or .claude/product-marketing.md to gather context. This creates a surface for indirect prompt injection where an attacker could place instructions in those files to override agent behavior.
Ingestion points: The agent is instructed in SKILL.md to read documentation from .agents/product-marketing.md, .claude/product-marketing.md, or product-marketing-context.md.
Boundary markers: The skill lacks delimiters (e.g., XML tags or triple quotes) or specific 'treat as data' instructions to prevent the agent from executing instructions found within the ingested context files.
Capability inventory: The agent can read files, process information, and interact with the user, which could be exploited to misguide the user if the context files are poisoned.
Sanitization: There is no mechanism in the instructions to filter, escape, or validate the content of the marketing documentation before it is processed by the agent.

marketing-ideas