The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill parses log files generated by external commands to determine its next steps. If a file being validated produces log output containing spoofed fix markers, it could trick the agent into executing arbitrary skills or following malicious instructions.
Ingestion points: The skill reads console.N.log and various check logs from the validator_logs/ directory in Step 3 and Step 4.
Boundary markers: The skill uses simple text markers like --- Fix Instructions --- and --- Fix Skill: <name> --- to identify actions, which are easily spoofed in standard output/stderr of a validated process.
Capability inventory: The agent possesses powerful capabilities including Bash for shell execution and the Task tool for subagent delegation, both of which are used to process the potentially poisoned log data.
Sanitization: There is no evidence of sanitization, validation, or human-in-the-loop confirmation before the agent attempts to follow the instructions or invoke the skills extracted from the logs in Step 5.

validator-check