The Agent Skills Directory

[PROMPT_INJECTION]: The skill uses high-pressure, absolute language designed to override the agent's internal logic and decision-making processes. Evidence includes directives like "EXTREMELY-IMPORTANT," "ABSOLUTELY MUST," "not negotiable," and "not optional." It explicitly instructs the agent that it "cannot rationalize" its way out of these instructions, which is a common pattern in behavioral override injections. Additionally, the Codex reference file provides specific guidance on framing subagent messages using XML tags and authoritative directives to ensure the model treats them as system-level instructions.
[INDIRECT_PROMPT_INJECTION]: The skill mandates a policy of invoking and following external skills if there is even a "1% chance" they apply, specifically instructing the agent to do this BEFORE asking clarifying questions. This significantly expands the agent's attack surface by forcing the ingestion of instructions from potentially untrusted files with minimal filtering.
Ingestion points: The Skill tool (or platform equivalents like activate_skill) is the primary mechanism for loading external skill files into the agent context.
Boundary markers: There are no boundary markers or instructions to treat invoked skill content as untrusted; rather, the agent is told to "Follow skill exactly."
Capability inventory: The referenced tool mappings across all platforms include highly privileged capabilities such as Bash (shell access), Write/Edit (file system modifications), and Task/spawn_agent (subagent creation).
Sanitization: No sanitization, validation, or human-in-the-loop verification is required before the agent begins executing the logic found in an invoked skill.

using-superpowers