The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill has a surface for indirect prompt injection by reading external content from a local file and user input without utilizing boundary markers or sanitization logic.
Ingestion points: The agent is instructed in SKILL.md to "re-read the file from disk" before every write and to capture everything the user says, including the "initial prompt," as fragments.
Boundary markers: There are no specific delimiters or instructions in SKILL.md to ignore potential instructions embedded within the fragments.
Capability inventory: The skill possesses file read and append capabilities as described in SKILL.md to manage the fragment document.
Sanitization: No filtering, escaping, or validation of the content being read or written is specified in SKILL.md or agents/openai.yaml.

writing-fragments