The Agent Skills Directory

[PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection because it interpolates user-controlled $ARGUMENTS directly into the system prompt without sanitization or boundary markers.
Ingestion points: The $ARGUMENTS variable in the <context> and <process> sections allows arbitrary user input to enter the agent's context.
Boundary markers: There are no delimiters (e.g., XML tags, triple quotes) or instructions to the agent to treat the input as untrusted data.
Capability inventory: The skill possesses powerful capabilities through allowed-tools such as Bash, Write, Edit, Read, and WebFetch, which could be abused if an injected instruction is followed.
Sanitization: The skill does not perform any validation, filtering, or escaping on the user-provided design ideas before processing them.

gsd-sketch