The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill maintains a persistent memory of patterns and strategies that is automatically updated based on user-provided content, creating a surface for indirect prompt injection.
Ingestion points: Untrusted data is received via the input parameter and processed in the <content> block as defined in SKILL.md.
Boundary markers: The skill uses XML-style <content> tags in the prompt dispatched to the immune-scan agent, but it lacks explicit instructions to the agent to ignore or escape instructions embedded within the scanned content.
Capability inventory: The skill has the capability to write to persistent local storage (immune_memory.json and cheatsheet_memory.json) in Step 3 and 3b, and subsequent executions read and inject this data back into the agent context in Step 0 and Step 2.
Sanitization: The skill does not perform sanitization or validation on the new_threats_detected or new_strategies_detected fields generated by the immune-scan agent before writing them to the memory files. A malicious input could trick the scanner into persisting prompt injection payloads that would then affect future agent operations.
[DYNAMIC_EXECUTION]: The scripts/retrieve.py utility performing task-conditioned retrieval dynamically modifies the Python module search path (sys.path) at runtime to import the task_signature module from a computed relative directory.

immune