The Agent Skills Directory

[PROMPT_INJECTION]: The skill exhibits a surface for indirect prompt injection as it processes untrusted inputs from both user arguments and external configuration files without explicit sanitization steps. * Ingestion points: Untrusted data enters the agent's context through the $ARGUMENTS field (specifically via the --task and --override flags) and through the contents of the config.yaml file. * Boundary markers: The instructions do not specify any delimiters or boundary markers to differentiate untrusted data from the core logic, nor do they include warnings to ignore instructions that might be embedded within the task names or configuration values. * Capability inventory: The skill has access to the Read tool for accessing local files and the Bash tool (restricted to the test command), which provides an execution surface if malicious input is successfully interpolated into tool parameters. * Sanitization: There is no evidence of sanitization, validation, or escaping of external content before it is used to generate the routing decision or potentially passed to the authorized tools.

research-router