The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection because it reads content from a user-editable markdown file and re-incorporates it into the agent's context. * Ingestion points: The agent is instructed in SKILL.md to re-read the entire markdown file from disk before every write operation to preserve user edits. * Capability inventory: The agent has capabilities to read and write to the local file system to manage fragments within the target markdown file. * Boundary markers: The skill does not implement delimiters or specific instructions to treat the file content as untrusted data. * Sanitization: No validation or sanitization is performed on the fragments being read from or written to the file.
[NO_CODE]: No executable scripts, source code files, or binaries were detected within the skill package, which limits the scope for traditional software-based attacks.

writing-fragments