The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and act upon content from files located in the .humanlayer/tasks/ directory, such as structure outlines, research documents, and design discussions. Since these files are external data sources, they could potentially contain malicious instructions intended to divert the agent from its primary task.
Ingestion points: Files matching *-structure-outline.md, *-research.md, and *-design-discussion.md within .humanlayer/tasks/TASKNAME (SKILL.md).
Boundary markers: No explicit delimiters or instructions to ignore embedded commands are specified when reading these files.
Capability inventory: The agent has access to the Bash tool for directory listing, the Agent tool for launching subagents, and the Read tool for accessing file contents.
Sanitization: There is no evidence of sanitization or validation of the content retrieved from the task documents before it is processed or passed to the subagent.
[COMMAND_EXECUTION]: The skill explicitly instructs the agent to use Bash(ls -La ...) for directory discovery in SKILL.md. While this is used for a legitimate purpose (handling symlinks), direct interaction with the shell via variables like TASKNAME presents a surface for potential command injection if the input is not strictly validated by the platform.

implement-outline