The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection because it incorporates external, potentially untrusted data into its context.\n- Ingestion points: Untrusted data enters the agent context through the $ARGUMENTS variable and by reading the founder/facts.md, founder/product-brief.md, and founder/user-interviews.md files.\n- Boundary markers: The instructions do not employ delimiters or specific instructions to the agent to disregard commands embedded within the processed data.\n- Capability inventory: The skill's capabilities include Read and Edit tools, which are restricted to the founder/ directory. It does not have access to shell execution or network operations, limiting the potential impact of an injection.\n- Sanitization: There is no evidence of data sanitization or validation performed on the ingested content before it is processed by the model.

persona-gen