The Agent Skills Directory

[PROMPT_INJECTION]: The skill spawns a sub-agent using the Agent tool and populates its prompt with a verbatim copy of a previous run's report, creating a surface for indirect prompt injection.
Ingestion points: The template in SKILL.md (Step 1 under 'Do this') includes a placeholder <PASTE HERE> for the previous run's full report.
Boundary markers: The prompt uses weak markers (square brackets and a colon) to delineate the untrusted content, which is insufficient to prevent an LLM from obeying instructions embedded within the report data.
Capability inventory: The sub-agent is granted access to the Read, Bash, and Agent tools, which could be leveraged if an injection is successful.
Sanitization: No sanitization, escaping, or explicit 'ignore instructions' warnings are applied to the interpolated report data.
[COMMAND_EXECUTION]: The skill uses the Bash tool to perform git-related operations to verify findings against the project's history.
Evidence: Step 3 in SKILL.md instructs the agent to use grep on git log and commit messages to verify if a failure has occurred in previous runs.

adaptogen-critique