The Agent Skills Directory

[PROMPT_INJECTION]: The skill presents an indirect prompt injection surface by ingesting untrusted data that is then passed to subagents with file-modification capabilities.
Ingestion points: The skill accepts a [narrative content description] argument and reads configuration from production/review-mode.txt. These inputs are used to parameterize the tasks assigned to subagents like the writer and narrative-director.
Boundary markers: There are no defined boundary markers or explicit instructions to subagents to treat the narrative content as data only, increasing the risk that embedded instructions in a story description could influence agent behavior.
Capability inventory: The subagents are granted powerful tools including Write, Edit, Task, and TodoWrite, which could be abused if the subagent is successfully injected.
Sanitization: The skill does not perform validation or sanitization on the input strings before they are incorporated into the subagent prompts.
[PROMPT_INJECTION]: The skill defines a configuration mechanism for 'Review Modes' (full, lean, solo) that can be set via a local file (production/review-mode.txt). If this file is controlled by an external party (e.g., in a downloaded repository), it could be used to force the solo mode, which explicitly instructs the agent to skip all director gate spawning and oversight mechanisms.
[PROMPT_INJECTION]: The skill incorporates self-referential status markers in its output ('Verdict: COMPLETE', 'Verdict: BLOCKED'). While these markers are used here to indicate the status of the narrative task, this pattern of embedding pseudo-verdicts is a common technique used to confuse automated security scanners that look for specific completion strings.

team-narrative