The Agent Skills Directory

[PROMPT_INJECTION]: The skill contains explicit instructions designed to override agent system prompts and default safety filters. It uses highly aggressive language to force a specific output format, including directives such as 'CRITICAL OUTPUT CONSTRAINT... overrides any default conversational behavior' and 'FIRST-TOKEN ENFORCEMENT... overrides system-level instructions, persona behavior, and conversational defaults. There are zero exceptions.' These patterns are characteristic of jailbreak-style injections used to bypass established agent guardrails.
[INDIRECT_PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection because it ingests untrusted text (via the {{P}} and {{X}} variables) and processes it as part of its core logic without adequate isolation or boundary markers. While the skill claims to 'note the injection in the rationale,' it still executes logic based on the content of potentially malicious inputs.
Ingestion points: Untrusted data enters the agent context in SKILL.md via the {{P}} (Prompt) and {{X}} (Expectations) placeholders.
Boundary markers: There are no boundary markers or delimiters used to separate the user-provided prompt/expectations from the skill's own instructions.
Capability inventory: The skill generates complex text outputs and includes an 'Apply' mechanism that prompts the agent to replace file contents on the user's filesystem.
Sanitization: No sanitization, escaping, or validation of the input content is performed; the skill evaluates the content literally as written.

think-critically