The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process data from multiple external markdown files located in the founder/ directory, which presents a surface for indirect prompt injection.
Ingestion points: The agent is instructed to read founder/facts.md, founder/product-brief.md, founder/competitor-matrix.md, founder/pricing-strategy.md, founder/go-to-market.md, founder/metrics-dashboard.md, and founder/fundraise-prep.md.
Boundary markers: The instructions do not define any specific delimiters or clear instructions for the agent to treat the contents of these files as data rather than instructions.
Capability inventory: The skill is configured with access to WebSearch, WebFetch, and the ability to write to files via Edit(founder/**).
Sanitization: There is no evidence of sanitization or filtering applied to the data retrieved from the local files before it is processed by the agent.
Risk: If an attacker can influence the content of these local files (for example, by including malicious instructions in a competitor analysis that was copied from the web), they could potentially influence the agent's behavior, such as exfiltrating data via the available web tools.

pitch-deck