The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection as it ingests and processes content from untrusted local files.
Ingestion points: The skill reads strategy files (e.g., strategies/<name>/strategy.py) and external rule files (algo-expert/rules/self-hosted-strategies.md) using the Read, Glob, and Grep tools.
Capability inventory: The agent is granted high-privilege tools including Bash, Edit, and Write, which could be exploited if the analyzed content contains malicious instructions that override the agent's behavior.
Boundary markers: The skill lacks explicit boundary markers or instructions to treat the content of the files being analyzed as data rather than instructions.
Sanitization: There is no evidence of content sanitization or validation to prevent embedded instructions in the analyzed files from being executed by the agent.

algo-host