The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted external data (referred to as a 'Contract') and uses it to generate 'Work Packages' that include executable shell commands.
Ingestion points: The 'Decomposition Process' section in SKILL.md instructs the agent to read the 'Contract' section by section to identify requirements.
Boundary markers: No explicit delimiters or warnings to ignore embedded instructions within the processed data are provided to the agent.
Capability inventory: The skill format includes a bash verification block and instructions for file creation/modification and writing checkpoints to the local file system (docs/gangsta/...).
Sanitization: No mention of sanitizing or validating the content of the 'Contract' before it is used to generate commands or file paths.
[COMMAND_EXECUTION]: The 'Work Package Format' includes a section for 'Verification' using bash commands. The skill encourages the agent to generate and potentially execute these commands based on external task requirements, which creates a vector for executing arbitrary code if the source instructions are compromised.

the-underboss