The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill ingests and processes untrusted user input ('topic') to drive its core logic of ranking and executing other frameworks.
Ingestion points: User-supplied situation or problem description is read in SKILL.md (Step 1) and processed according to references/engine.md (Step 0).
Boundary markers: There are no explicit delimiters (e.g., XML tags or triple quotes) or 'ignore' instructions wrapping the user input to prevent it from containing malicious agent instructions.
Capability inventory: The skill has the capability to read any SKILL.md or template file within the skills/ directory and execute the instructions contained therein.
Sanitization: The instructions lack specific sanitization steps for the user-provided topic before it is interpolated into the ranking and execution workflows.
[DYNAMIC_EXECUTION]: The skill uses a dynamic logic to determine which local instruction sets (other framework skills) to load and follow at runtime.
Evidence: references/engine.md describes a process where the agent must 'Open the framework by slug' and 'Run the framework's own Instructions' based on a relevance score calculated from the user input. While the scope is restricted to the local library, this pattern of dynamic instruction loading increases complexity and potential for logic abuse.

think-top3