The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill ingests markdown documentation artifacts which could contain malicious instructions designed to subvert the agent's review logic. \n- Ingestion points: Artifact content is read in the 'Inventory' pass (SKILL.md) and processed by scripts/checks.py and scripts/merge.py. \n- Boundary markers: No delimiters or safety instructions are defined to separate artifact content from the agent's operational instructions. \n- Capability inventory: The skill utilizes shell commands (cat, python3) and installs external packages (pip install), creating a risk if an injection is successful. \n- Sanitization: Documentation content is processed without explicit sanitization or validation. \n- [COMMAND_EXECUTION]: The skill requires the agent to execute shell commands such as pip install "jsonschema>=4.20,<5", cat, and python3. These commands are used for standard setup and data merging but represent a capability that could be exploited if combined with an injection attack.

critique-docs