The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted external data in the form of thesis proposal drafts, which presents a surface for indirect prompt injection attacks.
Ingestion points: According to SKILL.md, the skill reads a draft file named by the user or found in the workspace's proposal location (e.g., a subdirectory defined in guidelines.md).
Boundary markers: The instructions do not specify the use of delimiters (such as XML tags or unique markers) to isolate the untrusted proposal content from the skill's own operational instructions.
Capability inventory: The skill has the capability to read local files (references/guidelines.md, workspace guidelines.md, and the proposal itself) and write files to the local filesystem (specifically creating or overwriting <slug>-review.md).
Sanitization: There is no evidence of sanitization, filtering, or safety-preamble instructions intended to prevent the agent from following instructions embedded within the analyzed proposal text.

proposal-review