The Agent Skills Directory

[PROMPT_INJECTION]: The SKILL.md file contains instructions that use highly imperative and restrictive language designed to override the agent's autonomous decision-making.
Evidence includes the use of custom XML-like tags such as <EXTREMELY-IMPORTANT> and absolute directives like "YOU DO NOT HAVE A CHOICE," "This is not negotiable," "This is not optional," and "You cannot rationalize your way out of this."
These patterns are used to force the agent to prioritize specific skill tool invocations over its default logic or user clarifying questions.
[INDIRECT_PROMPT_INJECTION]: The skill defines a mandatory workflow for ingesting and acting upon untrusted external data related to iOS and Swift projects, which presents a surface for indirect injection.
Ingestion points: The skill triggers on project files (.xcodeproj, .xcworkspace), user mentions of specific frameworks, and error reports, all of which are external and potentially attacker-controlled.
Boundary markers: The instructions lack any guidance on using delimiters or boundary markers to isolate project data from the agent's instruction context.
Capability inventory: The skill mandates the invocation of specialized tools and other skills (ios-build, ios-ui, ios-data, etc.) based on the ingested content.
Sanitization: There are no instructions provided for sanitizing, escaping, or validating the external project content before the agent processes it or uses it to determine tool selection.

axiom-using-axiom