The Agent Skills Directory

[PROMPT_INJECTION]: The user-provided '$ARGUMENTS' variable is placed at the end of the instructions without any boundary markers or specific instructions to treat the input as data rather than instructions. This creates a surface for direct prompt injection attacks aiming to override the agent's behavior.
[DATA_EXFILTRATION]: The skill provides both file-reading capabilities ('Read', 'Grep') and network-access capabilities ('WebFetch'). While intended for research, this tool combination creates a risk where the agent could be manipulated into reading sensitive local files and transmitting the contents to an external domain.
[INDIRECT_PROMPT_INJECTION]: The skill is susceptible to malicious instructions embedded in the web content it retrieves.
Ingestion points: Data fetched from external URLs using 'WebSearch' and 'WebFetch' (SKILL.md).
Boundary markers: No delimiters or safety instructions are used to wrap the fetched external content to prevent the agent from executing instructions found within that content.
Capability inventory: The agent can list files ('git ls-files', 'Glob'), read files ('Read', 'Grep'), and perform network requests ('WebSearch', 'WebFetch').
Sanitization: The skill does not define any methods for sanitizing or filtering the content retrieved from external sources before it is synthesized into a response.

question