The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill directs the agent to read and execute instructions from external files without explicit boundary markers or sanitization, creating a vulnerability to malicious instructions embedded in the task queue or mailbox system.
Ingestion points: Instructions are retrieved from <team_state_root>/team/<teamName>/workers/<workerName>/inbox.md, <team_state_root>/team/<teamName>/tasks/task-<id>.json, and <team_state_root>/team/<teamName>/mailbox/<workerName>.json.
Boundary markers: None provided; the instructions explicitly state to "follow any instructions" found in these files.
Capability inventory: The agent is authorized to use the rcs CLI tool for messaging and task lifecycle management, and has general file system access within the team_state_root.
Sanitization: There are no instructions to sanitize, escape, or validate the content of the external files before acting upon them.
[COMMAND_EXECUTION]: The skill provides shell command templates for the rcs team api tool that interpolate values from environment variables and external state. If the sources for <teamName>, <workerName>, or <MESSAGE_ID> are compromised, this could lead to command injection via the shell templates.
Evidence: The protocol includes templates like rcs team api send-message --input "{\"team_name\":\"<teamName>\",\"from_worker\":\"<workerName>\",\"to_worker\":\"leader-fixed\",\"body\":\"ACK: <workerName> initialized\"}" --json.

worker