The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill architecture relies on a multi-stage pipeline where data from one skill is captured and reused as context for subsequent steps, creating a vulnerability surface for instruction injection.
Ingestion points: In SKILL.md (Phase 3, Step 2), the instructions direct the agent to capture the output from a completed skill and inject it directly as context when invoking the next skill in the chain.
Boundary markers: Absent. The instructions do not require the use of delimiters or 'ignore embedded instructions' warnings when interpolating captured data into new prompts.
Capability inventory: The skill is granted access to high-capability tools, including Bash, Task, and Skill (as specified in the SKILL.md frontmatter), which could be misused if an injection bypasses safety guardrails.
Sanitization: Absent. No logic is provided to validate, filter, or escape natural language instructions that might be contained within the data passed between skills.

skill-composer