The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes external 'artifacts' using file-read operations which serves as an ingestion point for untrusted data.
Ingestion points: The inspect stage uses the file-read atom to ingest content from existing artifacts into the agent context.
Boundary markers: The instructions in SKILL.md lack explicit delimiters or warnings to ignore potential instructions embedded within the design artifacts being refined.
Capability inventory: The skill possesses fs:read and fs:write capabilities, and utilizes atoms like patch-edit and diff-review which could be manipulated by malicious content in a processed file.
Sanitization: There is no evidence of sanitization or filtering applied to the content read from artifacts before it is processed by the refinement loop.

refine-critique-loop