The Agent Skills Directory

[PROMPT_INJECTION]: The skill employs extremely forceful language to hijack the agent's decision-making process. The <EXTREMELY-IMPORTANT> section uses phrases like "ABSOLUTELY MUST", "YOU DO NOT HAVE A CHOICE", "MUST USE IT", "not negotiable", and "not optional" to override agent autonomy. The "Red Flags" section further instructs the agent to ignore its own internal reasoning by labeling it as "rationalizing." Additionally, the skill provides specific "Message framing" in references/codex-tools.md designed to force subagents into strict instruction adherence by using XML tags and explicit directives to "Output ONLY the structured response," which can be used to suppress safety-oriented summarization or warnings.
[INDIRECT_PROMPT_INJECTION]: The skill establishes a high-privilege environment where external content (referenced as "skills") is loaded and followed "exactly" before any other interaction occurs. This creates a vulnerability surface where the agent is predisposed to execute instructions from external skill files.
Ingestion points: User messages and content loaded via the Skill or activate_skill tools.
Boundary markers: None present in the instructions to delimit or verify external content.
Capability inventory: Shell execution (bash, run_shell_command), file system manipulation (Write, Edit, replace), network operations (web_fetch), and subagent dispatch (Task, spawn_agent).
Sanitization: No sanitization, validation, or integrity checks for the invoked skill content are provided.
[COMMAND_EXECUTION]: The platform mapping files (references/codex-tools.md, references/copilot-tools.md, references/gemini-tools.md) explicitly document and enable the use of shell execution tools like bash and run_shell_command. While these are platform-provided, the skill instructs the agent to use them to perform environment detection and execute workflows defined in external skills.
[DYNAMIC_EXECUTION]: The skill provides detailed instructions in references/codex-tools.md for dynamically assembling subagent instructions. This process involves reading external prompt files, filling placeholders with runtime data, and wrapping the result in XML tags to ensure the subagent treats the generated string as an authoritative system-level directive.

using-superpowers