The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted external content (Target and Supporting Context) to generate its simulation.
Ingestion points: The Target (prose, code, or skill) and Supporting context inputs defined in SKILL.md are processed as authoritative sources for the simulation.
Boundary markers: The skill lacks explicit instructions to disregard natural language commands that might be embedded within the Target data, potentially allowing embedded instructions to influence agent behavior during simulation.
Capability inventory: The agent is instructed to write the simulation report to a "resolved destination" (file system), which could be manipulated if injected instructions redirect the output or alter the content.
Sanitization: No input sanitization or validation of the Target content is performed before simulation.
[PRIVILEGE_ESCALATION]: The skill requests the ability to write files to a repository-relative destination.
Evidence: SKILL.md Procedure 5 ("write it at the resolved destination") and Control D ("repository-relative Markdown destination") describe the file-writing capability.
Mitigation: The skill includes a safety check in Procedure 1: "Revising an existing destination requires explicit user authority" and "stop when the requested destination exists without revision authority."

callstack-simulation