The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection because it is designed to ingest and process external data dictionary files (xlsx, csv, markdown) which could contain malicious instructions meant to influence the agent's behavior.
Ingestion points: Data dictionaries and candidate variables are read into the agent's context during the 'Tier 0' and 'Tier 1' phases described in SKILL.md.
Boundary markers: The instructions lack specific delimiters or clear guidelines to ignore embedded instructions within the user-supplied data dictionaries.
Capability inventory: The skill requires access to powerful tools such as Bash, Write, and Edit, as specified in the SKILL.md frontmatter, which could be exploited if an injection occurs.
Sanitization: No evidence of data sanitization, validation, or escaping of the input data is provided in the instructions.
[COMMAND_EXECUTION]: The skill instructions in SKILL.md specify an 'Exit gate' that requires running an external script named check_dictionary_citations.py using the agent's shell capabilities.
Evidence: The text states: 'Exit gate: check_dictionary_citations.py (or equivalent) PASS on the operationalization table before running Tier 1.'
Risk: This script is not provided within the skill package, creating a dependency on an unverified external resource that the agent is explicitly instructed to execute via the Bash tool.

define-variables