The Agent Skills Directory

[PROMPT_INJECTION]: The instructions employ coercive and imperative language designed to override the agent's standard operational logic and internal reasoning. The use of phrases like 'ABSOLUTELY MUST', 'non-negotiable', and 'not optional' combined with the statement that skills 'override default system prompt behavior' is a pattern used to bypass agent constraints.
Evidence: 'Opencode skills override default system prompt behavior', 'YOU DO NOT HAVE A CHOICE. YOU MUST USE IT.', 'This is not negotiable.', 'You cannot rationalize your way out of this.'
[INDIRECT_PROMPT_INJECTION]: The skill establishes a mandatory workflow that requires the agent to invoke and obey external 'skill' files if there is even a '1% chance' they apply. This creates a significant surface for indirect prompt injection because it forces the agent to load and 'follow skill exactly' for external content that may contain malicious instructions.
Ingestion points: The skill tool invocation described in SKILL.md which loads external skill files into context.
Boundary markers: Absent; the skill lacks instructions to sanitize or check the safety of the loaded content, instead mandating strict adherence.
Capability inventory: Invocation of the skill tool to load external content.
Sanitization: No validation or sanitization of the loaded skill content is mentioned in the workflow.

using-superpowers