The Agent Skills Directory

[PROMPT_INJECTION]: The template file assets/general/agent-skill-architecture.md contains a section titled 'Master Skill Architect System Prompt'. This section uses role-play and imperative instructions (e.g., 'Role: You are an expert AI Engineer...', 'Your sole purpose is to...', 'You must adhere to...') to attempt to redefine the agent's identity and override its original system instructions and safety constraints.
[INDIRECT_PROMPT_INJECTION]: The skill's architecture for drafting and restructuring documents is vulnerable to instructions embedded within the content it processes. Ingestion points: User-supplied document content provided as an argument (referenced as argumentHint in SKILL.md). Boundary markers: The instructions in SKILL.md and references/document-authoring.md do not specify any delimiters or ignore-embedded-instruction warnings for the input data. Capability inventory: The skill possesses the capability to write to the filesystem, as it is designed to produce 'drafted or restructured document' outputs. Sanitization: There is no evidence of input validation, escaping, or sanitization before the content is processed by the agent.
[DYNAMIC_CONTEXT_INJECTION]: The assets/general/agent-skill-architecture.md file includes shell injection patterns using the ![ command ] syntax, such as ![ pwd ], ![ find . -maxdepth 2 -not -path '/.' ], and ![ cat package.json ]. On supported platforms, these commands execute automatically when the file is loaded, allowing the skill to silently discover project structure, directory paths, and dependencies.

document-authoring