The Agent Skills Directory

[PROMPT_INJECTION]: The skill instructions include a directive to conceal intermediate processing steps from the user. In the 'Mandatory Process' section of SKILL.md, the agent is instructed: "Do not produce visible output until the final step, unless blocked." While this is likely intended to reduce chat noise, it suppresses the transparency of the agent's intermediate logic and tool usage during execution.
[INDIRECT_PROMPT_INJECTION]: The skill is vulnerable to indirect injection as it ingests and processes data from the local workspace to generate code without sufficient boundary controls.
Ingestion points: The agent reads existing workflow source files (src/workflows/*.workflow.ts) and workspace-relative documentation (knowledge-base/index.json, node-types/index.txt) using read_file and execute_command.
Boundary markers: There are no explicit instructions or delimiters defined to prevent the agent from following instructions that might be embedded in the files it reads from the workspace.
Capability inventory: The agent possesses high-impact capabilities including workspace_write_file, workspace_str_replace_file, workspace_execute_command, and build-workflow.
Sanitization: The skill does not specify any sanitization or validation routines for content retrieved from external files before it is used in the generation of new code artifacts.
[DYNAMIC_EXECUTION]: The skill uses dynamic execution to validate agent-generated TypeScript files. In SKILL.md, the 'Mandatory Process' (Step 7) requires the agent to run node --import tsx node_modules/@n8n/workflow-sdk/dist/cli/index.js validate <filePath> on the generated source file. This command invokes the tsx loader to execute the generated code for linting and validation purposes, which represents a risk if the generation process is compromised.

workflow-builder