The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process external data (specifications and named source files) to generate task instructions, which creates a potential vector for indirect prompt injection.
Ingestion points: According to the Method section in SKILL.md, the skill reads content from a 'spec' and 'every named source'.
Boundary markers: The skill uses YAML frontmatter and specific Markdown headers (## Source, ## Agent instructions) to structure the output packets. While these provide logical separation, they are not designed to sanitize or block malicious instructions embedded within the source content.
Capability inventory: The skill performs file-write operations to the ~/.agents/artifacts/ directory and includes a Close method that deletes files from the file system based on human disposition.
Sanitization: No explicit sanitization or escaping mechanisms are defined for the source text that is copied 'verbatim' into the task packets, allowing potentially malicious instructions to propagate to downstream agent actions.

sus-task