The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and analyze external content from several sources including {slug}-summary.md, {slug}-timeline.md, and an optional repo_path. This creates a surface for indirect prompt injection attacks where malicious instructions hidden in the source material could influence the agent's behavior.
Ingestion points: Data is read from talks/{YYYY}-{slug}-summary.md, talks/{YYYY}-{slug}-timeline.md, and various files within the directory specified by repo_path (e.g., AI configuration files, code patterns).
Boundary markers: The instructions do not specify any boundary markers (such as XML tags or triple quotes) or provide guidance to the agent to disregard instructions embedded within the source files.
Capability inventory: The skill utilizes the Read and Write tools, which grant the agent the ability to access and modify files on the local filesystem. This could be abused if an injected instruction directs the agent to overwrite sensitive files or exfiltrate data via the Write tool.
Sanitization: There is no mention of content sanitization, escaping, or validation before the ingested material is processed by the agent's logic.

talk-stage3-concepts