The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill scans the local filesystem for challenge artifacts and flags, which introduces a risk of indirect prompt injection if challenge files contain malicious instructions intended to manipulate the agent.
Ingestion points: The skill uses find . and grep -rniE ... . within the workflow in SKILL.md to identify and likely read the content of exploit scripts and log files.
Boundary markers: The instructions do not define clear delimiters or provide the agent with guidance to ignore embedded instructions found within the challenge data or scripts it processes.
Capability inventory: According to the allowed-tools in the frontmatter, the agent has access to Bash, Write, Edit, WebFetch, and WebSearch, which could be abused if an injection is successful.
Sanitization: There is no evidence of sanitization, escaping, or validation of the file contents before they are incorporated into the agent's context for summarization.

ctf-writeup