The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest data from user-provided URLs and local project context files such as .agents/product-marketing.md. This represents a surface for indirect prompt injection if these external sources contain malicious instructions intended to manipulate the agent's behavior.
Ingestion points: Reads project-specific marketing context from .agents/product-marketing.md, .claude/product-marketing.md, or product-marketing-context.md (specified in SKILL.md and references/form.md). It also processes content from user-provided URLs.
Boundary markers: The instructions do not define specific delimiters or "ignore" instructions for the content of the ingested files.
Capability inventory: The skill's capabilities are limited to generating text recommendations and copy alternatives. It does not perform file writes, network requests (other than reading the target URL), or subprocess execution.
Sanitization: There is no explicit sanitization or filtering of the ingested content mentioned in the skill instructions.
[SAFE]: The skill performs no dangerous system operations, contains no obfuscated code, and does not exhibit patterns of data exfiltration or credential theft. The use of project metadata for context is a standard feature for AI agents in this environment.

cro