The Agent Skills Directory

[PROMPT_INJECTION]: The validate_with_llm function in SKILL.md is vulnerable to indirect prompt injection as it interpolates untrusted external content directly into an LLM prompt template.
Ingestion points: The content parameter provided to process_document is passed as original_text to the LLM validation step.
Boundary markers: None. The prompt template lacks delimiters (e.g., XML tags or triple quotes) or specific instructions for the model to ignore any commands found within the source text.
Capability inventory: The logic depends on the LLM's response to correct data extractions; an attacker-controlled input could influence the final parsed output by providing malicious instructions.
Sanitization: No input sanitization or validation is performed on the source text before it is used in the prompt.

regex-vs-llm-structured-text