The Agent Skills Directory

[PROMPT_INJECTION]: The skill exhibits an indirect prompt injection surface through its delegate architecture.
Ingestion points: SKILL.md accepts raw user content via the {{USER_INPUT}} placeholder, which is then passed directly into the system prompts of dynamically spawned expert sub-agents.
Boundary markers: The delegation logic lacks delimiters (e.g., XML tags or triple quotes) or specific 'ignore embedded instructions' warnings for the sub-agents when processing this input.
Capability inventory: Sub-agents are granted access to a wide array of methodology and case study files in the knowledge/ directory to perform their analysis.
Sanitization: There is no evidence of filtering or sanitization logic to prevent users from embedding instructions that might attempt to override the sub-agents' expert personas or extract internal knowledge files.

bmz