The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and semantically analyze external, user-provided research artifacts (ARAs) which include files like PAPER.md, logic/claims.md, and trace/exploration_tree.yaml. These files constitute an untrusted data surface where an attacker could embed malicious instructions (e.g., hidden prompt injections) intended to hijack the agent's execution flow.
[INDIRECT_PROMPT_INJECTION] Evidence Chain:
Ingestion points: The skill explicitly reads multiple user-controlled files from the artifact directory during Step 1 and Step 2 of its procedure (e.g., SKILL.md lines 61-72).
Boundary markers: Absent. The instructions lack specific guidance on using delimiters (like XML tags or triple backticks) or "ignore embedded instructions" warnings when processing the content of the research artifacts.
Capability inventory: The skill leverages Read, Write, Glob, and Grep tools (documented in SKILL.md line 16), which could be abused to modify the filesystem if the agent is successfully injected.
Sanitization: Absent. There is no evidence of filtering or sanitizing the input data from the research artifacts before it is processed by the model's semantic reasoning engine.

ara-rigor-reviewer