The Agent Skills Directory

[PROMPT_INJECTION]: The skill processes content from several local file directories which constitutes a surface for indirect prompt injection. If files in the source directories are compromised or contain adversarial content, it could influence the agent's behavior during analysis or when delegating to sub-agents.
Ingestion points: The skill reads from propositions/, customers/, context/context-index.json, and portfolio.json.
Boundary markers: The instructions do not specify any delimiters or warnings to treat ingested file content as untrusted data.
Capability inventory: The skill utilizes Write, Edit, and Agent (for sub-agent delegation) tools, which could be leveraged if the agent is influenced by malicious data.
Sanitization: There is no evidence of validation or sanitization of the data read from project files before it is processed or passed to tools.

compete