The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted Korean text provided by users or read from the file system. This creates a potential vector for indirect prompt injection if the input text contains malicious instructions intended to influence the agent's behavior during the analysis or rewriting process.
Ingestion points: Text is ingested from user messages or through the Read tool as specified in the workflow in SKILL.md.
Boundary markers: The instructions do not define specific delimiters (e.g., XML tags or triple quotes) to separate the user-provided text from the skill's own instructions, nor do they explicitly command the agent to ignore instructions embedded in the data.
Capability inventory: The skill is authorized to use Read, Write, Edit, Grep, Glob, and AskUserQuestion. While it lacks network access or arbitrary code execution, the Write and Edit capabilities could be misused to modify local files if an injection attack is successful.
Sanitization: No sanitization or validation of the input text is described in the logic to mitigate the risk of processing malicious command-like strings disguised as Korean prose.

humanizer