The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and act upon external, potentially untrusted data, which creates a vulnerability to indirect prompt injection.
Ingestion points: The instructions in SKILL.md explicitly mandate that the agent "Always read company-context.md before responding," which serves as an entry point for external data.
Boundary markers: There are no defined delimiters or specific instructions (e.g., "treat the following as data only") to prevent the agent from following malicious instructions that might be embedded within the company-context.md file.
Capability inventory: The skill includes the execution of local Python scripts (scripts/ops_efficiency_analyzer.py and scripts/okr_tracker.py) that are likely to process or analyze the data found in the external context file.
Sanitization: The skill does not describe any sanitization, validation, or escaping mechanisms for the data retrieved from the company context before it is interpolated into the agent's reasoning process or passed to execution tools.

coo-advisor