The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill presents an attack surface for indirect prompt injection because its core function is to ingest and process untrusted customer data (e.g., .drawio diagrams, XML test cases, and source code).
Ingestion points: Data enters the agent context through the parsing of customer artifacts in the local workspace or via Google Drive links, as described in SKILL.md and specialized ingestors like ingestors/files/drawio/SKILL.md.
Boundary markers: There are no explicit instructions or delimiters defined to isolate the content of the ingested files from the agent's control logic, nor are there instructions to ignore embedded commands within the source data.
Capability inventory: The skill possesses significant capabilities, including the ability to spawn multiple specialized subagents, write to the filesystem using append_turn.py, and generate comprehensive HTML reports using construct_report.py. It also references the gdrive skill for external data access.
Sanitization: While construct_report.py correctly uses html.escape to protect the final HTML output from XSS, there is no evidence of sanitization or validation of the input content before it is interpreted by the LLM during the discovery and extraction phases.

cxas-cuj-report-generator