The Agent Skills Directory

[PROMPT_INJECTION]: The skill employs aggressive, absolute language (‘ABSOLUTELY MUST’, ‘YOU DO NOT HAVE A CHOICE’, ‘not negotiable’) intended to override the agent's autonomy and any conflicting user instructions. It includes a ‘Common Rationalizations’ section designed to preemptively suppress the model's logical or safety-based hesitation. Specifically, the ‘Instructions ≠ Permission to Skip Workflows’ section tells the agent to disregard the user’s intent if it conflicts with the skill's mandatory procedures.
[INDIRECT_PROMPT_INJECTION]: The skill mandates a ‘Mandatory First Response Protocol’ where the agent is forced to search for and read external files (‘skills’) before responding to any message.
Ingestion points: Uses the ‘Skill’ tool to read files matching patterns like **/workflows/** or **/rules/** from the workspace.
Boundary markers: No boundary markers or sanitization instructions are provided for the content of the skills being read.
Capability inventory: The skill utilizes the Skill tool for reading/executing files and the TodoWrite tool for task management.
Sanitization: None detected; the agent is instructed to ‘Follow the skill exactly’ regardless of its content, which creates a high-risk surface for executing malicious instructions found in untrusted files.

using-superpowers