The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection through the interpolation of untrusted user input.
Ingestion points: The $ARGUMENTS placeholder in SKILL.md directly accepts user-provided strings which are then placed within the <instructions> block.
Boundary markers: While the skill uses <instructions> tags to encapsulate the user input, it lacks strong delimiters or explicit directives for the agent to ignore any adversarial instructions that might be embedded within those arguments.
Capability inventory: The skill utilizes powerful tools including Task (which can spawn subagents to explore code) and Write (which can modify files). This combination allows a successful injection to potentially exfiltrate information discovered during exploration or perform unauthorized file modifications.
Sanitization: There is no evidence of input sanitization, filtering, or validation before the user-supplied data is incorporated into the prompt.

interview