The Agent Skills Directory

[PROMPT_INJECTION]: The skill uses an $ARGUMENTS placeholder within the <additional_requests> block, which interpolates untrusted user input directly into the prompt. This can be exploited to provide instructions that override the intended behavior of the agent.
[PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection due to its processing of untrusted files from the repository.
Ingestion points: The agent reads source code and documentation files using the Read and Grep tools based on output from git diff.
Boundary markers: The skill lacks explicit markers or instructions to isolate the content of ingested files from the agent's instructions, potentially leading the agent to follow commands embedded in the files.
Capability inventory: The agent is equipped with tools for shell command execution (Bash), file modification (Write, Edit), and task creation (TaskCreate).
Sanitization: There is no evidence of sanitization or validation of the file content before it is processed by the agent.

docs-update