The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill enriches index files by extracting the description field from the YAML frontmatter of markdown files and writing this content back into a central mapping file. This architecture creates a vulnerability where a malicious description in a source file could influence the agent's context or behavior when it subsequently reads the aggregated index.
Ingestion points: YAML frontmatter within agents/*.md and skills/*/SKILL.md files located in the project root.
Boundary markers: The instructions do not define boundary markers (such as XML tags or triple backticks) to separate the extracted metadata from the index file's structure, nor do they instruct the agent to disregard instructions within the extracted text.
Capability inventory: The skill uses file system read and write operations to modify files within the .cartographer/ directory.
Sanitization: There is no requirement for the agent to sanitize, escape, or validate the description text before placing it into the index files.

map-ecosystem