The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and interpret external data artifacts (e.g., artifacts/runs.json, artifacts/events.jsonl, artifacts/results.json) to generate reports. These files represent an untrusted input surface where malicious instructions could be embedded to influence the agent's analysis.
Ingestion points: The skill instructions and prompts (e.g., SKILL.md and prompts/skill-evaluation.md) direct the agent to read and interpret various artifact files from the workspace.
Boundary markers: The instructions lack explicit boundary markers or directives to the agent to treat data from these artifacts as strictly non-instructional, increasing the risk that embedded commands could be followed.
Capability inventory: The skill's primary workflow involves executing shell commands via the skill-up CLI tool and using agent-based judges, which could be influenced or abused if the agent is misled by injected content in the artifacts.
Sanitization: There are no mentioned mechanisms for sanitizing, escaping, or validating the contents of the artifact files before they are processed by the agent.

skill-evaluation