The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill implements a routing mechanism that instructs the agent to navigate the filesystem and ingest the full content of sibling SKILL.md files into its context. This creates a vulnerability surface where the agent's behavior is determined by content loaded from external files at runtime.
Ingestion points: The skill explicitly directs the agent to read instructions from relative paths: ../bigdata-skill/SKILL.md, ../financial-data-collector/SKILL.md, ../gangtise-copilot/SKILL.md, ../ashare-news-fetcher/SKILL.md, and ../daymade-sector-research/SKILL.md.
Boundary markers: The instructions contain logic to verify the file path (ensuring it is a direct sibling and following symlinks), but they lack prompt-level boundary markers or instructions to treat the loaded content as potentially untrusted data.
Capability inventory: The skill utilizes file system read operations to load instructions into the agent's active context.
Sanitization: There is no evidence of sanitization, filtering, or validation of the content within the target SKILL.md files before they are integrated into the current session's instructions.

financial-router