The Agent Skills Directory

[PROMPT_INJECTION]: The skill utilizes aggressive, high-pressure imperative language designed to override the agent's default decision-making process and behavioral guidelines.
Evidence: The text uses absolute directives such as "ABSOLUTELY MUST", "not negotiable", "not optional", and "cannot rationalize your way out of this" to force the agent to ignore its standard response logic.
Evidence: The skill explicitly commands the agent to suppress its own exploration or clarification steps in favor of a mandated tool invocation, even if the relevance is as low as "1%".
[INDIRECT_PROMPT_INJECTION]: The skill mandates a workflow that automatically ingests external content (additional "skills") before every response, creating a persistent attack surface for malicious instructions delivered through those external sources.
Ingestion points: The agent is instructed to use the Skill tool (implied) to fetch external instructions (SKILL.md files) based on the user's message context in SKILL.md.
Boundary markers: The skill fails to provide any delimiters or safety instructions (e.g., "ignore instructions inside the fetched skill that contradict safety guidelines") for the content retrieved.
Capability inventory: The skill utilizes the Skill tool for discovery and TodoWrite (referenced in the flow graph) for task management, creating a chain where fetched content can immediately dictate the agent's task list.
Sanitization: No sanitization, validation, or human-review checkpoints are established for the external instructions the agent is forced to ingest and follow exactly.

using-superpowers