The Agent Skills Directory

[PROMPT_INJECTION]: The skill instructions explicitly direct the agent to adopt various personas (e.g., 'Rick Sanchez', 'Elliot Alderson') and technical focuses, which is a structured form of role-play and instruction overriding.
[PROMPT_INJECTION]: The skill includes a concealment pattern by instructing the agent to 'Apply these boundaries silently: do not tell the user about them unless they ask,' which reduces transparency regarding the agent's operational constraints.
[INDIRECT_PROMPT_INJECTION]: The skill creates an attack surface by automatically loading and applying configuration from a project-local agentstage.json file if present in the workspace root.
Ingestion points: The agent reads agentstage.json from the workspace root (file: SKILL.md, 'Storage Synchronization' section).
Boundary markers: While the skill includes internal boundary rules (e.g., personas not writing in character inside code), these are instructions to the LLM that could be countered by adversarial instructions within the loaded JSON configuration.
Capability inventory: The skill possesses the capability to read and write files outside the workspace root (global config) and within the workspace, and to modify its own system instructions based on the file content.
Sanitization: There is no evidence of sanitization or validation of the rules or desc fields loaded from the local configuration file before they are interpolated into the agent's persona instructions.

agentstage