The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill possesses a surface for indirect prompt injection as it is designed to ingest and process data from external sources and project files, which could contain adversarial instructions.
Ingestion points: Workflow step 3 in SKILL.md explicitly instructs the agent to retrieve original sources or existing data when facts are needed.
Boundary markers: The instructions do not specify the use of delimiters or specific XML-style wrapping to isolate untrusted external content from the agent's core instructions.
Capability inventory: The skill claims access to the host's file system, search engines, CLI, and browser capabilities as defined in the 'Execution boundary' section of SKILL.md and the skill.yaml manifest.
Sanitization: There is no evidence of automated sanitization, filtering, or instruction-stripping for content retrieved from external sources before it is analyzed by the agent.

lov-think