The Agent Skills Directory

[PROMPT_INJECTION]: The skill is designed to ingest and process technical documents which are untrusted external inputs, creating a surface for indirect prompt injection where embedded instructions could influence agent behavior. Ingestion points: Reads external files provided to the review command using the Read tool. Boundary markers: The specification mentions persona attribution markers to identify section ownership, but lacks descriptions of robust delimiters to isolate untrusted content from the agent's core instructions. Capability inventory: The skill utilizes Bash, Read, and Write tools, providing a significant surface for system interaction. Sanitization: No explicit sanitization or content validation for the input documents is described in the provided specification.
[COMMAND_EXECUTION]: The skill is authorized to use the Bash tool to perform documentation-code alignment checks. The availability of a general-purpose shell tool increases the impact of any successful prompt injection or logic flaw.
[DATA_EXFILTRATION]: The skill is designed to access internal system files including source code located in services/*/main.py and configuration in embry.yaml to verify the accuracy of documentation claims. While intended for alignment verification, accessing implementation details represents a risk of exposing sensitive system information.

review-paper