The Agent Skills Directory

[PROMPT_INJECTION]: The skill accepts user-provided input through the $ARGUMENTS variable, which is placed inside <task_description> tags. This input is used to generate a structured task prompt. An attacker could use this field to provide instructions that attempt to bypass the skill's constraints or inject malicious steps into the resulting worker task.
[INDIRECT_PROMPT_INJECTION]: This skill serves as a prompt generator for downstream agents, creating an indirect injection surface. Malicious instructions provided by a user could be carried over into the generated task, potentially influencing the next agent in the workflow.
Ingestion points: User input is ingested via the $ARGUMENTS variable in SKILL.md.
Boundary markers: The input is enclosed within <task_description> tags, providing some structural delimitation, though this does not prevent the model from following embedded instructions.
Capability inventory: The skill itself does not possess dangerous capabilities like file writing or network access. However, the output it generates is intended for a 'worker agent' and includes templates for shell commands such as git add and git commit.
Sanitization: There is no evidence of sanitization, filtering, or escaping of the user-provided input before it is processed to generate the worker task.

generate-task