The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill ingests user-provided content descriptions which are propagated to multiple sub-agents tasked with generating and writing files.
Ingestion points: The [narrative content description] argument in SKILL.md serves as the primary entry point for untrusted data.
Boundary markers: The instructions do not define specific delimiters (such as XML tags or triple quotes) or 'ignore embedded instructions' warnings when passing user input to the sub-agents via the Task tool.
Capability inventory: The orchestrator spawns sub-agents including narrative-director, writer, and world-builder using the Task tool. These sub-agents have access to Write, Edit, and TodoWrite tools, allowing them to modify the local filesystem based on the processed narrative input.
Sanitization: There is no evidence of input validation, filtering, or escaping for the user-provided description before it influences the behavior of the sub-agents or the pipeline.
Self-referential content: The skill instructions specify an output format using 'Verdict: COMPLETE' and 'Verdict: BLOCKED' headers. While these are clearly intended as status markers for the narrative workflow, they mimic the structure of automated analyzer reports, which is a common pattern in self-referential injection attempts targeting security tooling.

team-narrative