The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from local files, creating a potential vector for indirect prompt injection.
Ingestion points: Phase I (Orientation) explicitly instructs the agent to read "local orientation documents", "primers", and "historical session state" (Context Snapshot) files as part of its environment initialization in SKILL.md.
Boundary markers: The instructions do not specify the use of delimiters, XML tags, or "ignore embedded instructions" warnings when incorporating data from these external files into the context.
Capability inventory: The skill has access to Bash, Read, and Write tools. Furthermore, it describes delegating execution to external CLI tools (such as agy, claude, and copilot) for sub-agent delegation, which increases the potential impact if the ingested data contains malicious instructions.
Sanitization: There are no instructions for sanitizing or validating the content of the orientation or snapshot files before processing.
[PROMPT_INJECTION]: The skill uses strong imperative and adversarial-style language (e.g., "CRITICAL: Anti-Simulation Rules", "PROTOCOL VIOLATION", "YOU MUST ACTUALLY PERFORM THE STEPS") to override the model's natural behavior patterns. While intended to enforce a rigorous workflow and prevent the agent from merely summarizing actions, this technique mirrors common prompt injection patterns used to override core instructions.
[COMMAND_EXECUTION]: The skill instructs the agent to execute shell commands for dependency management (pip install -r ./requirements.txt) and describes a "Dual Loop" mode that involves executing various LLM CLI backends (agy, claude, copilot) based on user selection and session parameters. The execution of arbitrary CLIs through shell commands increases the skill's attack surface.

learning-loop