The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill exhibits an indirect prompt injection surface by processing untrusted user data into a new prompt construction.
Ingestion points: The $ARGUMENTS placeholder in SKILL.md is used to inject user-provided task descriptions directly into the skill's context.
Boundary markers: The skill lacks delimiters (like XML tags or triple quotes) or specific instructions to the agent to disregard embedded commands within the user input.
Capability inventory: The skill is primarily a text transformation tool that outputs a prompt for the user to review. It does not request tool access, file system permissions, or network capabilities.
Sanitization: The instructions specifically mandate that the agent must 'Keep the user's facts, names, and numbers verbatim,' which ensures that any malicious instructions or payloads contained in the user's input are preserved in the final output prompt.

wider