The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes the contents of SKILL.md files found within the plugins/ directory. These files represent untrusted data that could influence the agent's decision-making process during its compliance audit.
Ingestion points: Data enters the agent's context through the Read tool, which is used to extract the §Chains and §Done When sections from various SKILL.md files.
Boundary markers: The skill relies on specific section headers to delimit data but does not employ robust boundary markers or "ignore embedded instructions" warnings when interpolating this external text into its internal audit logic.
Capability inventory: The skill is granted access to Bash, Glob, Grep, and Read. Crucially, it lacks Write or Edit permissions, meaning it cannot directly modify the filesystem based on malicious input.
Sanitization: There is no evidence of sanitization or strict schema validation performed on the text extracted from the audited skills before it is evaluated against the classification criteria.

return-path-gate