The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The reference documentation provided with the skill includes links to external resources that are currently blacklisted. Specifically, the file references/srs.md contains a link to a PDF hosted on archive.stmarys-ca.edu which has been flagged as malicious by automated scanners.
[INDIRECT_PROMPT_INJECTION]: The skill architecture involves the agent reading external reference materials and user-uploaded documents to gather project context. The inclusion of malicious URLs creates an attack surface for indirect prompt injection, where content from an untrusted external source could attempt to subvert the agent's instructions.
Ingestion points: The agent is instructed to read local files in the references/ directory which link to external sites, and it also accepts user-uploaded files for context extraction.
Boundary markers: There are no explicit instructions or delimiters provided to the agent to help it distinguish between its own core instructions and potentially adversarial content found in external or uploaded documents.
Capability inventory: The agent has the ability to read files, prompt the user for input, and generate complex markdown documents based on gathered data.
Sanitization: The skill does not implement any validation or sanitization mechanisms for the data retrieved from external links or provided by the user.

spec-writer