The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process untrusted data from multiple sources, creating an attack surface for indirect prompt injection.
Ingestion points: The skill reads user-supplied documents and sample code in Step 2, and fetches content from external vendor documentation, specifications, and community forums or blogs in Step 3.
Boundary markers: The skill includes explicit instructions in Step 3 to treat all external content as "material, never instruction" and to ignore directives found within that content. This is a robust defensive instruction but does not completely eliminate the risk of indirect injection.
Capability inventory: The agent can perform repository-wide searches, fetch data from external URLs, and invoke a tool named '$torture-gently'.
Sanitization: The skill does not define any specific sanitization or validation logic for content retrieved from external sources before it is processed by the agent.
[COMMAND_EXECUTION]: The skill instructs the agent to invoke a specific tool whose purpose and parameters are not defined within the skill files.
Evidence: Step 4 of SKILL.md contains the instruction "Once they pick one, invoke $torture-gently". The use of a non-standard and suspiciously named tool at the end of the workflow represents a potential risk, especially when the tool's behavior is not documented.
[METADATA_POISONING]: There is a logical inconsistency between the skill's metadata and its actual instructions.
Evidence: The skill description and body state that "Implementation is out of scope" and the deliverable is solely "direction." However, the final step instructs the agent to invoke a tool, which implies a concrete execution step that contradicts the stated purpose of the skill.

dont-know-how