The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes and executes external SKILL.md files, which creates a vulnerability to indirect prompt injection if the source skill contains malicious instructions. * Ingestion points: Reads and scores source SKILL.md content in Phase 1 and captures execution traces in Phase 2. * Boundary markers: The distillation instructions do not specify the use of delimiters or 'ignore' commands to isolate the source skill content from the distiller's control logic. * Capability inventory: The skill is capable of executing model reasoning and tool calls in Phase 2 (Trace Collection) and Phase 5 (Validation) based on the instructions in the skill being processed. * Sanitization: No evidence of input validation, filtering, or sanitization was found for the ingested skill instructions.

skill-distiller