The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes external, untrusted content (review reports and source code) and uses that information to perform file modifications, which creates a potential vulnerability where malicious instructions in the data could be executed by the agent.
Ingestion points: Step 1 in SKILL.md requires the agent to assemble "Reports under audit", "The reviewed target", and "Terrain sources" (external documentation) as primary input paths.
Boundary markers: The instructions do not define strict delimiters or boundary markers to isolate these external artifacts from the agent's instruction stream, increasing the risk of the LLM following instructions embedded within the data.
Capability inventory: Step 4 explicitly mentions "Land edits, sync every mirrored copy... and record the audit trail," indicating the agent has file-write permissions that are triggered by the results of the audit process.
Sanitization: There are no documented procedures for sanitizing or escaping the content retrieved from the reports or terrain sources before the agent uses them to generate or apply edits.

challenge-audit