The Agent Skills Directory

[PROMPT_INJECTION]: The skill architecture creates an indirect prompt injection surface by design, as it requires the agent to read and process external, untrusted content for security analysis.
Ingestion points: Untrusted content enters the agent's context through file and directory analysis performed by the Read, Grep, and Glob tools based on the $ARGUMENTS input.
Boundary markers: There are no explicit instructions or delimiters defined to separate the content being analyzed from the agent's operational instructions, increasing the risk that the model might follow instructions found within the data.
Capability inventory: The agent's capabilities in this skill are restricted to reading and searching files (Read, Grep, Glob), which limits the potential impact of a successful injection to influencing the audit results or output logic.
Sanitization: The skill does not specify any sanitization or validation steps for the content fetched from external files before it is presented to the agent for reasoning.

prompt-injection