The Agent Skills Directory

[PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection because it is designed to ingest and analyze untrusted data from the user's environment to verify claims.
Ingestion points: The skill instructions specify that the agent must verify facts by reading 'code, git history, configs, docs, dependency versions' using tools like Read, Grep, and Bash (SKILL.md).
Boundary markers: The instructions do not include requirements for the agent to use delimiters or other boundary markers when processing these files, which increases the risk that instructions hidden in the files (e.g., in code comments or documentation) could be executed or followed.
Capability inventory: The agent has access to Bash, Read, Glob, and Grep, which provides a significant capability surface if the agent's logic is subverted by malicious file content.
Sanitization: There are no instructions for the agent to sanitize or escape the content it reads from the environment before incorporating it into its decision-making process.

question-it