The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes external data including user-provided plans, decision text, file paths, and code diffs. This creates a surface for indirect prompt injection where malicious instructions embedded in the analyzed files could attempt to influence the agent's behavior.
Ingestion points: The skill reads a target which can be plan/decision text, a file path, or a git diff range (SKILL.md).
Boundary markers: There are no explicit instructions to wrap external content in delimiters or use specific safety prompts to ignore instructions within the ingested data.
Capability inventory: The skill allows the agent to run tests and other read-only shell commands to gather evidence (SKILL.md).
Sanitization: No sanitization or validation of the input content is mentioned before the agent processes it.
[COMMAND_EXECUTION]: The skill explicitly permits the execution of shell commands to "run tests and read-only commands" (SKILL.md). While the instructions include safeguards such as prohibiting installation, migrations, or git state changes, the ability to execute code within the target environment is a functional requirement that carries inherent risks if the target code is malicious.

hl-challenge