The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from external sources and user-provided inputs, creating an attack surface where malicious content could influence the final report.
Ingestion points: The orchestration logic in SKILL.md (Stage 1) instructs subagents to use 'available retrieval' for public organization data and ingests user-provided ORGANIZATION and CONTEXT variables.
Boundary markers: The instructions include behavioral directives to 'describe what is actually true,' but do not employ structural delimiters (e.g., XML tags or clear boundaries) to separate untrusted retrieved data from the agent's internal logic.
Capability inventory: The skill is capable of writing a markdown report to the local file system using the save tool or equivalent file-writing capabilities.
Sanitization: There is no evidence of sanitization or filtering of content retrieved from the web before it is processed by the analyst subagents.- [COMMAND_EXECUTION]: The skill uses user input to determine the name of the file it saves, which could lead to unauthorized file placement.
Evidence: SKILL.md specifies saving the report to mckinsey-7s-<organization-slug>-<YYYY-MM-DD>.md in the working directory. If the <organization-slug> derived from the user-provided ORGANIZATION variable is not sanitized for path traversal characters (e.g., ../), the agent might attempt to write files to unintended locations.

mckinsey-7s