The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process content from external sources, creating a risk of indirect prompt injection if those sources contain malicious instructions.
Ingestion points: The skill reads test cases from eval/triggering-tests.yaml and extracts description fields from all SKILL.md files in sibling directories.
Boundary markers: There are no explicit delimiters or specific instructions for the agent to ignore embedded commands within the loaded descriptions or test cases.
Capability inventory: The skill is configured with the Read tool, allowing it to access and process various files in the local environment.
Sanitization: The instructions do not include any steps to sanitize, escape, or validate the content read from the filesystem before it is used in the matching process.
[DYNAMIC_CONTEXT_INJECTION]: The skill uses the !command syntax to execute a shell command (cat) at load time. This is used to automatically include the contents of eval/triggering-tests.yaml into the prompt. While this is used for legitimate internal data loading, execution of commands at load time is a sensitive capability.

ds-eval