The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from external skills, creating a potential vulnerability to indirect prompt injection.
Ingestion points: The skill reads SKILL.md, references/*, scripts/*, and assets/* from external skill directories during the audit process (identified in SKILL.md).
Boundary markers: The instructions do not define delimiters or specific safety warnings to the agent to treat the audited content as untrusted data or to ignore instructions embedded within those files.
Capability inventory: The skill is configured with access to the Bash, Read, Grep, and Glob tools, which provides a significant capability set that could be targeted by an injection attack.
Sanitization: The skill lacks sanitization, filtering, or validation of the content extracted from audited files before it is processed by the agent for evaluation.

solo-skill-audit