The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is designed to process and act upon instructions found in project-local files, creating an attack surface for indirect prompt injection.
Ingestion points: The skill ingests data from the target verification skill's SKILL.md file, all files within its features/ directory, and any referenced harness scripts.
Boundary markers: The instructions lack requirements for delimiters or specific directives to ignore potentially malicious prompts embedded within the ingested feature files or documentation.
Capability inventory: The agent has the capability to modify files (including SKILL.md and harness scripts) and drive the application (including launching processes and interacting with servers) based on the instructions it reads from these untrusted files.
Sanitization: No sanitization, validation, or escaping procedures are defined for the content extracted from the external feature files and scripts before the agent follows their guidance.

maintain-verification-skill