The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted content from challenge directories to generate writeups, which introduces a potential attack surface for indirect prompt injection.
Ingestion points: The agent is instructed to read solve.py, challenge files in the dist/ directory, and notes/debug output in the work/ directory (SKILL.md).
Boundary markers: There are no explicit instructions or delimiters defined to isolate untrusted data or warn the agent to ignore instructions embedded within the challenge files.
Capability inventory: The skill is configured with access to Bash, Write, Edit, Read, Grep, and Glob tools. If an injection were successful, an attacker-controlled file could potentially trigger these tools.
Sanitization: The skill lacks mechanisms to sanitize or validate the content of the files it gathers information from before the agent processes them.

writeup-generator