The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill indexes and processes untrusted markdown content from the local workspace without implementing boundary markers or sanitization, creating a surface for indirect prompt injection attacks. \n- Ingestion points: Step 2 of the workflow searches through the content of all .md files within the papers directory. \n- Boundary markers: The instructions do not define delimiters or provide warnings to the agent to disregard instructions found within the processed notes. \n- Capability inventory: The skill is configured with the write_file tool, which allows the agent to modify the workspace based on input derived from searched files. \n- Sanitization: No filtering or validation mechanisms are described to protect against instructions embedded in the paper notes.

paper-finder