The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection because it instructs the agent to ingest and analyze untrusted data from the local workspace, including configuration files and task execution logs, and then perform actions using the Bash(moon:*) tool based on that analysis.
Ingestion points: The agent reads data via moon task <target> --json, moon project <target> --json, and by directly reading workspace configuration files like moon.yml or lastRun.json.
Boundary markers: The instructions do not specify any delimiters or warnings to treat the ingested configuration data as potentially adversarial.
Capability inventory: The agent has access to the Bash(moon:*) tool, which allows it to execute moon CLI commands, potentially influenced by injected instructions in the config files it reads.
Sanitization: No sanitization or validation of the ingested workspace data is mentioned before the agent uses it to determine the next debugging steps.

debug-task