The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from repository files, including AGENTS.md, README.md, CONTRIBUTING.md, and CI configuration files, to perform audits or rewrites. This creates a surface where hidden malicious instructions in those files could influence the agent's behavior.
Ingestion points: The "Workflow" section in SKILL.md directs the agent to read existing project documentation, CI workflows, and package scripts.
Boundary markers: The instructions do not specify the use of delimiters or boundary markers to isolate the untrusted file content from the agent's internal instructions.
Capability inventory: The skill is capable of creating and modifying files (modes: Create, Improve, Nest) and generating audit reports.
Sanitization: No mechanisms for sanitizing or escaping ingested text are mentioned before the data is processed by the model.
[PROMPT_INJECTION]: The skill uses authoritative language to override the agent's default communication style in favor of a specific technical standard.
Evidence: references/communication.md includes a "Hard rule" for the ASD-STE100 standard, specifically instructing the agent: "Do not skip for tone, polish, or expertise" and "Do not send a reply until the prose passes these checks."

agents-md