The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is designed to process untrusted data sources (artefacts, repository history, and external references) and utilize system-level tools to verify facts, creating a surface for indirect prompt injection attacks.
Ingestion points: The agent reads user-provided artefacts, repository files, system logs, and external references such as URLs to identify "candidate facts" (SKILL.md).
Boundary markers: While the skill defines a structured markdown output format, it lacks clear boundary markers or instructions to isolate and ignore potentially malicious directives embedded within the ingested artefact data.
Capability inventory: The skill allows the use of Read, Write, Grep, Glob, and Bash. The "anchoring" procedure specifically encourages capturing the output of shell commands to verify system behavior, which could lead to command execution if an agent follows instructions found in an untrusted file (SKILL.md, references/briefing-format.md).
Sanitization: The skill does not provide mechanisms for sanitizing, validating, or escaping external content before it is processed by the agent or passed to downstream skills.
Multi-step chains: The skill is designed to produce briefings consumed by other skills (e.g., delphi-imagine), allowing injected instructions to potentially influence subsequent reasoning steps in an automated pipeline (SKILL.md).

delphi-ground