The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill exhibits an indirect prompt injection surface by taking untrusted user input and passing it to a sub-agent.
Ingestion points: User input enters the skill context via the $ARGUMENTS placeholder in SKILL.md.
Boundary markers: The skill does not employ any delimiters or structural markers (such as XML tags or explicit instruction blocks) to separate the user-provided content from the sub-agent's instructions.
Capability inventory: The skill uses the Task tool with subagent_type='consultant:consultant' to process the input.
Sanitization: There is no evidence of input validation, escaping, or filtering before the user content is interpolated into the consultant prompt.
[METADATA_POISONING]: The skill's description and documentation reference non-existent model versions, such as gpt-5.2-pro and claude-opus-4-5-20251101. While these may be intended as placeholders, they constitute deceptive metadata that misleads the user regarding the actual underlying model and its capabilities.

ask