The Agent Skills Directory

[PROMPT_INJECTION]: The instructions in SKILL.md use high-pressure, authoritative language ("ABSOLUTELY MUST", "not negotiable", "not optional") to force the agent to prioritize these skills over default system behavior. It explicitly states that "superjawn skills override default system prompt behavior," which is a technique used to bypass platform constraints or safety guardrails.
[INDIRECT_PROMPT_INJECTION]: The skill outlines a mechanism for "Named worker dispatch" that involves reading untrusted content from the file system and injecting it into sub-agent prompts.
Ingestion points: The agent is instructed to read content from external markdown files (e.g., agents/code-reviewer.md) in references/codex-tools.md.
Boundary markers: The skill recommends wrapping this external content in <agent-instructions> XML tags, which can be bypassed by sophisticated adversarial input.
Capability inventory: The skill describes tools for shell execution (bash, run_shell_command), file modification (write_file, edit), and spawning new agents (spawn_agent, task).
Sanitization: No sanitization, escaping, or validation of the external content is described before it is interpolated into the prompt.
[DYNAMIC_EXECUTION]: The skill provides templates for dynamic prompt assembly where it combines directive framing ("Your task is to perform the following") with external data and execution mandates ("Execute this now") to ensure strict adherence to dynamically loaded instructions.

using-superjawn