The Agent Skills Directory

[PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection because it interpolates untrusted user-provided content from the π.task and π.roles variables directly into agent prompts without sanitization or boundary markers.
Ingestion points: Untrusted data enters the context via the π.task and π.roles parameters in SKILL.md.
Boundary markers: The task content is appended to the agent instructions without using delimiters (such as XML tags or triple dashes) or specific instructions for the agent to disregard any commands embedded within the task.
Capability inventory: The agents spawned by this skill are granted the read, grep, find, and ls tools, providing them with the capability to browse and read the local file system if instructed by a malicious prompt.
Sanitization: There is no evidence of sanitization, validation, or escaping of the user-provided task before it is processed by the agents.

fabric-council