The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill's primary function is to ingest and process arbitrary text provided by users to perform 'humanizing' rewrites, which exposes the agent to potential indirect prompt injection attacks.
Ingestion points: Untrusted text provided by the user for processing in the SKILL.md task workflow.
Boundary markers: The instructions lack explicit requirements for using delimiters (like triple backticks or XML tags) or specific prompts to ignore system instructions embedded within the data being processed.
Capability inventory: The skill allows the use of powerful file-system tools including Write and Edit as specified in the allowed-tools metadata, which increases the impact if the agent follows instructions hidden within the data it is supposed to humanize.
Sanitization: There are no instructions or mechanisms provided to sanitize, filter, or escape the input text before the agent interprets and rewrites it.

humanizer