The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill instructs the agent to autonomously explore the environment (specifically referencing the filesystem and other tools) to find 'facts' related to the user's plan without user intervention. This behavior creates a significant surface for indirect prompt injection if the files or environment data accessed contain malicious instructions designed to subvert the agent's behavior during its 'fact-finding' phase.
Ingestion points: Data retrieved from the filesystem or other environment tools via autonomous sub-agents as specified in SKILL.md.
Boundary markers: The instructions lack any requirement for delimiters or 'ignore' directives when processing external facts.
Capability inventory: The skill explicitly authorizes filesystem access and the dispatching of sub-agents to use available tools.
Sanitization: There are no instructions for sanitizing or validating content retrieved from the environment before it is integrated into the design tree analysis.

grilling