The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process data from external, untrusted sources which could contain malicious instructions meant to influence the agent's behavior during synthesis.
Ingestion points: Untrusted data is ingested through the sub-agents' web search results from sources such as arXiv, GitHub discussions, Stack Overflow, and Reddit, as defined in the prompts for Subagent A and Subagent B.
Boundary markers: The prompts use {CLAIM} interpolation to insert user-provided technical claims but do not define clear delimiters or include instructions for the sub-agents to ignore potentially malicious embedded commands within the fetched content.
Capability inventory: The skill possesses the Agent tool to spawn sub-agents and the Write tool to save research findings to the local file system in the plans/active/ directory.
Sanitization: There are no documented procedures for sanitizing, escaping, or validating the content retrieved from the web before it is incorporated into the final report or written to the disk.

evidence-check