The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes data from external files which acts as an attack surface for indirect prompt injection.
Ingestion points: The skill reads artifacts/tweaks/<session-id>/state.yaml, artifacts/tweaks/<session-id>/pending.yaml, and the target HTML file provided in the <html-path> argument.
Boundary markers: Absent. The agent is instructed to read raw file content and extract specific blocks (like the __tweak_schema JSON inside a script tag) without explicit delimiters or warnings to ignore embedded instructions.
Capability inventory: The skill utilizes Read, Write, Edit, and limited Bash tools (ls, cat, mkdir, date, mv) to modify files on the filesystem.
Sanitization: While Step 3 includes schema validation for keys and value types (e.g., hex colors, numeric ranges), there is no sanitization of the file content against natural language instructions that might attempt to hijack the agent's logic during the Edit process.

apply-tweaks