The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from user arguments and referenced external files which are then handled by tools with significant capabilities.
Ingestion points: The agent is instructed in SKILL.md to read $ARGUMENTS and any files referenced by the user.
Boundary markers: The instructions lack explicit boundary markers or warnings to prevent the agent from executing instructions that might be embedded within the processed data or files.
Capability inventory: The skill utilizes a broad toolset including Read, Grep, Glob, Write, WebSearch, WebFetch, Agent, and Task. This allows it to perform network operations and filesystem writes based on potentially poisoned input.
Sanitization: The skill mentions using a [sanitized_topic] for the output filename in SKILL.md, which provides some protection against path traversal, but it does not specify sanitization for the data being passed to the Agent or WebSearch tools.

research-ideation