The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted external data through several input fields (e.g., {{topic_or_question}}, {{student_profiles}}).
Ingestion points: Inputs are interpolated directly into the system prompt via SKILL.md placeholders.
Boundary markers: The prompt does not use explicit delimiters or "ignore embedded instructions" warnings for these inputs.
Capability inventory: The skill has no dangerous capabilities; it does not list allowed-tools, lacks file-system access, and performs no network operations.
Sanitization: There is no evidence of input validation or escaping for the interpolated values.
Given the lack of executable tools or write capabilities, this represents a benign text-processing surface rather than a high-risk vulnerability.
[REMOTE_CODE_EXECUTION]: No patterns of remote script downloading, package installation, or command execution (such as curl | bash or pip install) were detected in the skill.
[DATA_EXFILTRATION]: The skill does not contain any logic for exfiltrating data. It lacks network access tools and does not access sensitive local file paths like .ssh or .aws credentials.
[DYNAMIC_CONTEXT_INJECTION]: The skill does not utilize the !command syntax for executing shell commands at load time.
[OBFUSCATION]: The content is presented in clear text with no evidence of Base64 encoding, zero-width characters, or homoglyph-based URL spoofing.

discussion-protocol-selector