The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and act upon untrusted task descriptions, which can influence its behavior and operations within the workspace.
Ingestion points: The accepted_card input defined in the SKILL.md frontmatter is the primary source of external instructions.
Boundary markers: While the Protocol section (Stage 1) instructs the agent to manually confirm the objective and scope, there are no technical boundary markers or system-level delimiters to prevent the contents of the accepted_card from overriding agent behavior.
Capability inventory: The skill is explicitly authorized to modify files (mutatesWorkspace: true) and execute shell commands for verification purposes (e.g., Stage 5 of the protocol in SKILL.md and the Immediate Local Verification section in references/mutation-containment.md).
Sanitization: The instructions do not define any sanitization, filtering, or validation steps for the incoming accepted_card content before it is used to drive implementation and command execution.

fable-execute