The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill acts as a processing engine for external and potentially untrusted data provided in the 'Target', 'Requirements', and 'Relevant context' fields, creating an attack surface for indirect prompt injection.
Ingestion points: The 'Required input' section in SKILL.md identifies multiple fields where untrusted data is ingested into the agent's context for review.
Boundary markers: The instructions do not define or require the use of explicit structural delimiters or boundary markers to isolate untrusted input from the skill's core instructions.
Capability inventory: The skill instructions in SKILL.md and references/output-schema.md explicitly enforce a 'read-only' policy, instructing the agent to return observations only and forbidding the issuance of commands, repair plans, or final verdicts.
Sanitization: There are no instructions for the agent to validate, filter, or sanitize the external data provided in the target artifact or requirements fields before processing.

generic-review