The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest untrusted user input and store it in workspace files (workflows/*.md, NOTES.md), creating a surface for potential instruction injection if the stored data is later processed by other agents or tools.
Ingestion points: User input provided during the interactive "grilling" session described in SKILL.md.
Boundary markers: The instructions do not specify any delimiters or safety markers to wrap the user-supplied content when writing to the workspace.
Capability inventory: The skill describes capabilities to create, edit, and delete files within the workflows/ directory and NOTES.md.
Sanitization: There is no requirement or logic provided for sanitizing or escaping the user input before it is written to the files.

loop-me