The Agent Skills Directory

[PROMPT_INJECTION]: The skill exhibits a surface for indirect prompt injection by reading and processing content from user-editable files in the chapters/ directory.
Ingestion points: Manuscript files located in chapters/*.md are scanned to extract note content using shell tools.
Boundary markers: The skill lacks explicit delimiters or specific instructions to ensure that the note content is treated strictly as data, potentially allowing instructions embedded in notes to be followed by the agent.
Capability inventory: The agent is instructed to read file context and perform file system writes (applying edits or removing markers) based on the extracted notes.
Sanitization: There is no evidence of input validation or filtering for the text contained within the note markers.
[COMMAND_EXECUTION]: The skill uses local shell commands to implement its functionality.
Evidence: The Implementation section of SKILL.md instructs the agent to run grep -rn '%%[A-Z]*:' chapters/*.md to find notes.

notes