The Agent Skills Directory

[PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection due to its core design of ingesting data from multiple untrusted sources to influence its responses and routing logic.
Ingestion points: The skill automatically loads data from data/**/*.json, including profile information, chronic condition trackers, medical records, and conversation history (data/ai-history.json).
Boundary markers: No explicit boundary markers (e.g., XML tags or specific delimiters) are defined in the instructions to isolate the ingested data from the system prompt or to instruct the agent to ignore embedded commands within that data.
Capability inventory: The agent is granted Read and Write tools, which it uses to access health files and update the conversation history.
Sanitization: There is no evidence of sanitization or validation logic to filter potentially malicious instructions embedded within the health records or history files before they are processed by the model.

health-chat