The Agent Skills Directory

Indirect Prompt Injection: The skill is designed to read external data from problem files or user input and designates this content as the 'authoritative text'. If this content contains malicious instructions disguised as math problems, the agent might attempt to process or follow them.
Ingestion points: The skill ingests untrusted data from the $ARGUMENTS variable and the DIR/problem.md file (which may be a copy of a user-provided file).
Boundary markers: While the skill establishes a specific file structure, it does not utilize explicit delimiters or 'ignore embedded instruction' warnings for the ingested problem text.
Capability inventory: The skill has access to Read, Write, Edit, and specific shell commands (mkdir, cp, cmp).
Sanitization: There is no explicit sanitization or validation of the mathematical text to filter out natural language instructions.
Command Argument Influence: The skill allows for a user-defined directory path (DIR=path) which is subsequently used as an argument in shell commands.
Evidence: The instructions specify using mkdir -p on the user-supplied DIR and copying files into that directory.
Context: While the allowed-tools strictly limit Bash usage to specific commands, providing a path to a sensitive system directory could lead to unintended file creation or modification within that location, depending on the agent's permissions.

solo