The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill demonstrates a vulnerability to indirect prompt injection by processing untrusted external data without sufficient isolation.
Ingestion points: According to SKILL.md, the agent is instructed to gather several external inputs, including the 'Research Dossier' and 'Author notes', which are typically controlled by the user or external sources.
Boundary markers: The instructions lack the use of clear delimiters or boundary markers (such as XML tags or triple backticks with explicit instructions to ignore embedded commands) to separate the skill's logic from the ingested data.
Capability inventory: The skill's primary capability is text generation and document production. While it does not involve command execution or network access, the outputted 'Chapter Outline Document' is explicitly intended for handoff to other agents like ghostwriter or draft-coach, potentially propagating injected instructions through the agent pipeline.
Sanitization: There are no instructions for the agent to sanitize, validate, or filter the external content before it is incorporated into the beat-level outline.

chapter-architect