The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill's primary function is to ingest, audit, and rewrite external text documents, which introduces a risk of indirect prompt injection.
Ingestion points: External documents are read by the agent through the scripts/audit.py utility for processing (e.g., python3 <SKILL_DIR>/scripts/audit.py <file.md>).
Boundary markers: The skill instructions emphasize 'Form, never content' and 'Conservation', but the implementation lacks technical boundary markers or specific system instructions to ignore embedded commands within the ingested data.
Capability inventory: The agent is tasked with rewriting sections of text based on audit hits and executing local scripts for verification (scripts/conservation.py), providing a capability chain that could be manipulated by adversarial content in the source file.
Sanitization: The strip_html function in audit.py removes formatting tags but does not sanitize the prose content against malicious prompt instructions.
[COMMAND_EXECUTION]: The skill uses local Python scripts to facilitate its audit and verification process.
The scripts/audit.py and scripts/conservation.py files are executed as part of the skill's standard workflow.
Source code analysis of these scripts shows they perform regex-based text analysis and comparison without utilizing network operations, sensitive file access, or dynamic code execution.

deslop