The Agent Skills Directory

[METADATA_POISONING]: The SKILL.md file contains contradictory instructions regarding tool usage. The 'Security' and 'Guardrails recap' sections explicitly state that the skill is 'read-only' and performs 'no writing to any tool,' while the YAML frontmatter configuration permits the use of Write and Bash tools. This discrepancy could lead to unexpected behavior if the agent follows the configured permissions rather than the textual constraints.
[INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from sales artifacts and URLs, creating a vulnerability to indirect prompt injection.
Ingestion points: Artifacts and URL content are loaded into the agent context in SKILL.md via the Read and WebFetch tools.
Boundary markers: No delimiters or safety instructions are used in SKILL.md to prevent the agent from executing instructions potentially hidden within the ingested artifacts.
Capability inventory: According to the frontmatter in SKILL.md, the agent is granted access to Bash, Write, Agent, and WebFetch tools.
Sanitization: The skill's instructions in SKILL.md do not include any steps to sanitize or validate the content retrieved from external sources.

prospect-panel-simulator