The Agent Skills Directory

[PROMPT_INJECTION]: Indirect prompt injection surface detected in the document review workflow.
Ingestion points: The skill reads the full text of documents from paths provided by the user or discovered via file-search/globbing tools in Phase 1 of SKILL.md.
Boundary markers: The subagent-template.md uses <review-context> XML-like tags to encapsulate the document content. However, it lacks explicit instructions to the sub-agent to disregard or ignore any instruction-like text embedded within the document content itself.
Capability inventory: The orchestrator skill possesses the capability to modify files using the platform's edit tool. In Phase 4 of SKILL.md, the skill is instructed to apply "auto-fixes" to the document in a single pass without seeking user approval. Additionally, it uses an Agent or spawn tool to execute sub-agents with the injected content.
Sanitization: There is no evidence of sanitization, escaping, or schema validation performed on the {document_content} variable before it is interpolated into the prompt template. This allows an attacker to include instructions in a document that could manipulate the sub-agent's JSON output, potentially causing the orchestrator to perform unintended edits to the filesystem.

document-review