The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes external audio and transcripts, creating a surface for indirect prompt injection attacks.
Ingestion points: Untrusted data enters the agent context through the audioUrl and the resulting transcript data in references/implementation.md.
Boundary markers: There are no explicit instructions or boundary markers defined in SKILL.md to ensure the agent ignores embedded commands found within the transcribed text.
Capability inventory: The skill is granted access to sensitive tools such as Bash(npm:*), Write, and Edit as specified in the allowed-tools section of SKILL.md, which could be leveraged if an injection is successful.
Sanitization: The implementation in references/implementation.md does not include validation or sanitization steps to filter out potentially harmful instructions from the transcript segments before they are processed by the AI.

twinmind-core-workflow-a