The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill ingests data from local workspace files and user input to generate workflow specifications, creating a surface for indirect prompt injection.
Ingestion points: The skill instructions specify reading from NOTES.md to identify tools, channels, and terminology.
Boundary markers: No explicit delimiters or instructions are provided to the agent to disregard instructions that might be embedded within the source notes.
Capability inventory: The skill allows the agent to create, edit, and delete files within the workflows/ directory, and write to NOTES.md.
Sanitization: There is no mention of filtering, escaping, or validating the content read from the workspace before it is processed by the agent.

loop-me