The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is built to ingest external task descriptions, which creates a potential vector for indirect prompt injection.
Ingestion points: The SKILL.md file defines a -f <path> flag that permits the agent to read context from an external "producer artifact" to define the task's scope and implementation logic.
Boundary markers: There are no explicit instructions for using delimiters or boundary markers to isolate the ingested content from the agent's core instructions, although the skill emphasizes strict adherence to the artifact's content.
Capability inventory: The skill allows the agent to perform multi-file code modifications ("Build"), delegate subtasks to parallel subagents, and write grounded implementation reports to the local filesystem under ~/.agents/output/.
Sanitization: No explicit sanitization or filtering of the input content is defined. The skill instead relies on Invariant 4 ("Verify adversarially"), which mandates that all claims and code changes be refuted by independent subagents in a fresh context before completion, acting as a logical mitigation against poisoned task descriptions.

ultrapex