The Agent Skills Directory

Indirect Prompt Injection Surface: The skill processes external, untrusted data including raw vulnerability documents, notes, and third-party findings. While this presents an attack surface where embedded instructions in processed files could attempt to influence the agent, the skill implements multiple safeguards. These include a structured sub-agent workflow, explicit human review requirements for all generated reports, and clear instructions to validate technical claims against source code rather than relying solely on supplied notes.
Ingestion points: Workflow steps in SKILL.md identify that raw notes, PoCs, and documents are ingested and passed to sub-agents.
Boundary markers: The skill uses markdown headings and a structured sub-agent prompt to provide context, though it does not use specific escape delimiters for untrusted content.
Capability inventory: The agent can launch sub-agents, perform file system operations for report generation, and use standard development tools like git, make, and ripgrep (rg).
Sanitization: The workflow mandates direct human review of all sub-agent output before acceptance, serving as a primary sanitization and validation layer.
Controlled Execution of Generated Content: The skill involves the creation and execution of Proof-of-Concept code, which is a necessary component of vulnerability research. To mitigate the risk of running potentially harmful code, the skill explicitly instructs the agent to use only authorized labs or virtual machines and strictly forbids testing against live production environments unless specifically directed by the user.
Metadata Consistency: The skill's description and interface configuration are consistent with its stated purpose of professional vulnerability documentation and research.

vulnerability-writeup