The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and evaluate content produced by other agents or users, referred to as "artifacts". This content is processed as natural language or code, which could contain malicious instructions meant to bypass the validator's scrutiny.
Ingestion points: The artifacts field in the check: block and user descriptions of work performed in SKILL.md serve as the primary entry points for external data.
Boundary markers: The skill does not define strict delimiters or isolation protocols to prevent instructions within the artifacts from being interpreted as agent commands.
Capability inventory: The skill possesses the capability to read any file in the workspace and inspect command outputs (SKILL.md).
Sanitization: There is no evidence of content sanitization, escaping, or filtering for the artifacts being processed.
[DATA_EXFILTRATION]: The skill instructions explicitly direct the agent to read files from the local filesystem to verify existence and correctness (existence check — does the file/output actually exist? Read it.). This confers a broad file-reading capability to the agent whenever it is tasked with validation.

impl-validator