The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill's core functionality relies on reading from and writing to an external issue tracker (e.g., GitHub or GitLab), which represents an untrusted data ingestion surface. Malicious actors with access to the issue tracker could inject instructions into issue bodies or comments to manipulate the agent's planning or tool execution during a session.
Ingestion points: The agent is instructed in SKILL.md (and the Portuguese translation TRADUCAO.pt-BR.md) to load the 'map' issue and its child tickets from the repository's issue tracker.
Boundary markers: The skill does not specify the use of delimiters (like triple-backticks or XML tags) or 'ignore' instructions when reading content from the tracker. This absence of clear boundaries increases the risk that the LLM will follow instructions found within the data as if they were part of its system instructions.
Capability inventory: The skill possesses significant capabilities, including the ability to invoke a 'Skill tool' for research, prototyping, and 'grilling', as well as the ability to spawn sub-agents to perform tasks. These capabilities provide a clear path for an injection attack to achieve functional impact.
Sanitization: The instructions do not describe any process for sanitizing, validating, or filtering the content retrieved from the external tracker before it is processed by the model.

wayfinder