The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from chat history and subagent reports, which is a common attack surface for indirect prompt injection.
Ingestion points: Instructions in SKILL.md direct the agent to "Collect your own work... reports from subagents, and messages from anyone else in this chat."
Boundary markers: None explicitly defined, although the skill instructions frame the output through a specific persona.
Capability inventory: The skill's attack surface is significantly restricted. The frontmatter includes disable-model-invocation: true. Furthermore, the instructions in SKILL.md explicitly mandate: "Keep this turn read-only" and "Do not change code, start an app or a job."
Sanitization: Not explicitly present; however, the restrictive capability instructions serve as a primary defense.
[SAFE]: The skill's design incorporates effective security constraints. By enforcing a read-only state and disabling model invocation, it mitigates the risk that malicious instructions embedded in the chat history could be executed by the agent.

ketchup