The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted prose and project-specific configuration files, creating a surface where malicious instructions could influence agent behavior.
Ingestion points: Untrusted data enters the agent context through the $ARGUMENTS variable, which can contain file paths, globs, or directly pasted text. The skill also explicitly seeks out and reads local files such as AUTHOR_VOICE.md and project style sheets.
Boundary markers: The instructions do not specify any delimiters or safety warnings to help the agent distinguish between the prose being reviewed and its own instructions, increasing the risk of the agent obeying instructions embedded within the text.
Capability inventory: The skill is capable of reading various files within the project directory and generating textual reports that include suggested code/text fixes.
Sanitization: There is no evidence of input sanitization or filtering to remove potential prompt injection patterns from the text files being processed.
Rule Precedence Risk: The skill instructions command the agent to prioritize rules found in external project files (AUTHOR_VOICE.md or user-stated rules) over its own built-in references. An attacker could use these files to provide instructions that override the agent's intended behavior.

review-writing