The Agent Skills Directory

[PROMPT_INJECTION]: The skill exhibits an attack surface for indirect prompt injection due to its data-handling workflow.
Ingestion points: The skill reads content from multiple files including bets/bets.md, experiments/archive/*, reviews/weekly/*, and strategy/learnings.md using state_read calls in SKILL.md.
Boundary markers: Content from these external sources is stored in variables (e.g., BETS, LEARNINGS, REVIEWS) and concatenated into the agent's context without delimiters or instructions to ignore embedded commands.
Capability inventory: The skill possesses the capability to write and append to files (retros/, playbooks/, and strategy/learnings.md) using state_write and state_append commands.
Sanitization: There is no evidence of data validation, escaping, or filtering of the content retrieved from the state files before it is processed by the agent.

retro