The Agent Skills Directory

[PROMPT_INJECTION]: The skill incorporates an indirect prompt injection surface because it processes untrusted user-provided data that could contain malicious instructions designed to manipulate the agent's output or tool usage.
Ingestion points: As defined in SKILL.md (Workflow Step 1), the agent reads user-supplied brand documents, product claims, persona files, and reference scripts.
Boundary markers: The instructions lack specific delimiters or structural boundaries (e.g., XML tags or clear headers) to isolate external data from the skill's operational logic.
Capability inventory: The skill is capable of invoking high-impact production tools ($video-batch-runner and $image-batch-runner) which perform hosted renders based on the generated content.
Sanitization: No logic is present to sanitize, validate, or escape the content ingested from the brief or reference files.
Mitigation: A user approval checkpoint is explicitly required in the workflow (Workflow Step 3) before handing off to production runners, which serves as a critical security control to prevent automated execution of injected instructions.

lifestyle-ad