The Agent Skills Directory

[PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection when processing untrusted markdown files. This occurs because the skill ingests external content and allows it to influence automated decision-making and file modification processes.
Ingestion points: Untrusted data enters the agent context via the FILE_PATH parameter in SKILL.md (Step 1 and Step 3), where the file is read and passed to persona-based analysis agents.
Boundary markers: The prompt templates used for persona agents in Step 3 of SKILL.md do not utilize any delimiters (such as XML tags or triple quotes) or specific instructions to ignore embedded commands, leaving the agent unable to distinguish between document text and potential malicious instructions.
Capability inventory: The skill and its sub-agents have access to a wide range of sensitive tools, including Read, Write, Edit, and Bash. A successful injection could leverage these tools to modify local files or execute unauthorized shell commands.
Sanitization: There is no evidence of content sanitization, filtering, or validation beyond checking for a .md file extension.

reader