The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes content from files that may be influenced by external parties, such as client inputs and research summaries, which can serve as a vector for malicious instructions.
Ingestion points: Reads data from part-01-client-inputs/stone-facts.json, part-02-external-research/, and part-04-competitive-customer-market/v1/4.3-customer-analysis.md.
Boundary markers: There are no instructions to the agent to treat these file contents as data only or to use specific delimiters to prevent command injection from within the content.
Capability inventory: The skill utilizes Write, Edit, and Bash tools, providing a significant capability surface if an injection were successful.
Sanitization: The instructions do not specify any filtering, escaping, or validation of the ingested content before it is processed for document generation.
[COMMAND_EXECUTION]: The skill instructions include the execution of an external Python script to manage the engagement state.
Evidence: The skill calls engagement-state.py bump-version to update version numbers in _engagement.json during re-runs.

four-core-documents