The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill exhibits a vulnerability surface for indirect prompt injection by ingesting untrusted data and interpolating it into a generated HTML document. While the skill enforces offline operation and prohibits external assets, it lacks specific guidance for the agent to sanitize or escape the user-provided topic before embedding it in the HTML structure.
Ingestion points: The untrusted data enters the agent context through the <topic> argument specified in the argument-hint and the workflow steps in SKILL.md.
Boundary markers: There are no explicit delimiters or instructions provided to the agent to treat the user-provided topic as potentially malicious or to ignore embedded instructions within that data.
Capability inventory: The skill possesses the capability to write a self-contained HTML file to the local filesystem using a slugified version of the topic as the filename. It does not have network access or subprocess execution capabilities according to its own constraints.
Sanitization: The workflow does not include instructions for HTML escaping, input validation, or filtering of the user-provided content before it is written to the output file.

tk-eli5