The Agent Skills Directory

[PROMPT_INJECTION]: The skill exhibits an attack surface for indirect prompt injection due to its core functionality of processing external, untrusted data.
Ingestion points: The skill ingests untrusted data through the $1 argument (Phase 1.1), which loads external documents such as HR communications, Performance Improvement Plans (PIPs), and meeting transcripts into the agent's context.
Boundary markers: The instructions do not define boundary markers (e.g., XML tags or delimiters) or provide specific directives for the agent to ignore potentially malicious instructions embedded within the user-provided documents.
Capability inventory: The skill possesses the capability to read local files from the user's career history and write detailed situation reports and strategic plans to a specified crisis_management directory.
Sanitization: There is no evidence of sanitization, filtering, or validation performed on the content extracted from external documents before it is interpolated into the agent's reasoning process.

code-red