The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted research data from a user-specified directory (<ara_dir>) and reasons over the content to generate answers.
Ingestion points: The skill reads multiple files within the artifact directory, including PAPER.md, logic/*.md, trace/exploration_tree.yaml, evidence/*.md, and source files in src/ as defined in CONTRACT.md and RETRIEVE.md.
Boundary markers: There are no explicit delimiters or markers instructing the agent to isolate the ingested file content from its own instructions, creating a surface for embedded malicious instructions to influence agent behavior.
Capability inventory: The skill uses Read, Grep, and Glob tools to access local data. It is restricted from network access and file system writes by instructions in CONTRACT.md and SKILL.md.
Sanitization: The skill does not perform validation or sanitization of the research data, relying on the agent to interpret the 'real prose' directly.

research-foresight