The Agent Skills Directory

[PROMPT_INJECTION]: The skill architecture is susceptible to indirect prompt injection because it ingests and processes untrusted external data (manuscripts) through a sequence of agents.
Ingestion points: User-provided manuscript files and metadata inputs (genre, publishing goals, and distribution platforms) are ingested and saved to _workspace/00_input.md in Phase 1, then subsequently processed by the manuscript-editor, proofreader, and cover-designer agents.
Boundary markers: The skill instructions do not define specific delimiters or "ignore embedded instructions" warnings to help agents distinguish between the provided manuscript content and the system's workflow instructions.
Capability inventory: The involved agents have capabilities to write files to the local file system (_workspace/ directory), perform inter-agent communication via SendMessage, and coordinate complex multi-step workflows with TaskCreate and TaskUpdate tools.
Sanitization: The workflow lacks explicit steps for sanitizing, filtering, or validating the manuscript content before it enters the agent team's processing pipeline, allowing potentially malicious instructions embedded in the manuscript to influence the agents' actions.

book-publishing