The Agent Skills Directory

[PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection due to its core workflow of reading and following external plan files.
Ingestion points: The agent is instructed to read website/site-plan.md (via the Read tool) to determine the website's structure and content.
Boundary markers: No explicit delimiters or instructions are provided to the agent to treat the content of the plan file as untrusted or to ignore any embedded instructions that might attempt to hijack the agent's session.
Capability inventory: The skill is permitted to use Bash, Write, and Edit tools, which provide the necessary permissions to modify the local file system and execute shell commands if requested by a malicious plan file.
Sanitization: There is no evidence of validation, filtering, or sanitization of the plan file's content before it is used to guide the agent's tool invocations.

build-website