The Agent Skills Directory

[PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection because it is designed to read and process external, untrusted script data and subsequently perform write operations based on that data.
Ingestion points: The tool read_script_for_extraction is used to ingest script content into the agent's context from an external file.
Boundary markers: The instructions do not define clear delimiters or "ignore instructions" warnings to prevent the agent from following potential malicious commands embedded within the script text itself.
Capability inventory: The skill has the capability to modify the project's state through multiple write-enabled tools: save_dedup_characters, save_dedup_scenes, and save_dedup_props.
Sanitization: There is no evidence of sanitization, validation, or escaping of the extracted strings (such as character names or scene descriptions) before they are passed to the storage tools.

extractor