The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The agent is instructed to read README.md or AGENTS.md files from candidate directories to determine their relevance to the current task. This behavior allows untrusted content from those files to enter the agent's context.
Ingestion points: Step 5 in SKILL.md explicitly directs the agent to read documentation files from candidate bookmark paths.
Boundary markers: The skill does not define specific boundary markers or delimiters to separate the ingested file content from the agent's control instructions.
Capability inventory: The agent is authorized to execute subsequent shell commands in the selected directory to 'Continue the user's task', which provides a path for actions influenced by injected instructions.
Sanitization: The skill lacks mechanisms to sanitize or validate the external file content before it is processed by the agent.
[EXTERNAL_DOWNLOADS]: The documentation provides instructions to install the required utility from the author's public repository.
Evidence: The README.md file specifies installation via go install github.com/primeapple/bookmarker/cmd/bm@latest. This targets the author's own repository using a standard development toolchain.

go