The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill operates on files within the workflows/ directory and NOTES.md, creating an ingestion surface for potentially untrusted data.
Ingestion points: The agent reads workflow specifications from workflows/*.md and raw notes from NOTES.md to inform its "grilling" process as described in SKILL.md.
Boundary markers: The instructions lack explicit delimiters or guidance for the agent to distinguish between its operational rules and instructions that might be embedded in the files it reads.
Capability inventory: The agent is instructed to create, edit, and delete files in the workflows/ directory, which represents a write capability based on processed input.
Sanitization: There is no mention of sanitization or validation logic for the content read from the workspace files.

loop-me