The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes user-supplied "plans, designs, or decisions" to formulate its interview questions. This ingestion of untrusted data creates a surface for instructions embedded within the user's plan to potentially influence the agent's logic.
Ingestion points: User input provided via the argument hint "<the plan, design, or decision to grill>" in SKILL.md.
Boundary markers: The skill lacks explicit delimiters (e.g., XML tags or triple quotes) or system instructions to ignore embedded commands within the user's plan.
Capability inventory: The agent is authorized to use Bash, Read, Grep, Glob, and WebSearch to verify facts and explore the environment.
Sanitization: There are no explicit instructions to escape or validate the interpolated user content before the agent processes it.
[COMMAND_EXECUTION]: The instructions direct the agent to "explore the environment — filesystem, git history, the codebase, the web" using its toolset to settle facts. While this is a core feature of the skill, the combination of direct system access via Bash and the processing of external plans increases the potential impact of an injection attack.

solo-grill