The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill ingests data from memory/contacts.md and $ARGUMENTS which may contain external content. This creates a surface for indirect prompt injection.
Ingestion points: memory/contacts.md (previous communication context) and $ARGUMENTS input field.
Boundary markers: There are no explicit markers or instructions to the model to ignore embedded commands within the ingested data.
Capability inventory: The skill uses the Write tool to save files to the workspace/ directory.
Sanitization: The skill lacks logic to sanitize, escape, or validate the ingested content before processing.

draft-message