The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes potentially untrusted data from user-provided proposals and repository files (via the Read, Glob, and Grep tools) and interpolates this content into prompts for sub-agents in Phase 2. This represents an indirect prompt injection surface where malicious instructions embedded in a proposal could attempt to influence the evaluation personas.
Ingestion points: User input and repository files read during Phase 1 of the SKILL.md workflow.
Boundary markers: The prompt construction logic described in Phase 2 and references/examples-and-errors.md does not explicitly mandate strict delimiters (such as XML tags or unique markers) to isolate the proposal content from the agent's system instructions.
Capability inventory: The skill utilizes the Agent tool to spawn sub-tasks and has access to Bash (used for repository status/logs in the referenced roast workflow) and standard file reading tools.
Sanitization: The instructions do not provide for filtering or sanitization of the proposals before they are passed to the personas.

multi-persona-critique