The Agent Skills Directory

[COMMAND_EXECUTION]: The skill utilizes the Bash tool and specifically instructs the agent to execute shell commands (e.g., cat << 'EOF' > file) to manage large file writes. The instructions explicitly state that the agent should perform these actions silently without seeking user permission.
[PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection because it ingests and processes data from external files that may contain untrusted instructions.
Ingestion points: Reads data from files in the refine-logs/ directory, specifically FINAL_PROPOSAL.md, REVIEW_SUMMARY.md, and REFINEMENT_REPORT.md.
Boundary markers: No explicit boundary markers or instructions to ignore embedded commands are present in the skill's logic for processing these files.
Capability inventory: The skill has access to high-privilege tools including Bash, Write, Edit, and Agent which could be exploited if malicious instructions are present in the ingested data.
Sanitization: There is no evidence of sanitization or validation of the content read from the logs before it is used to influence the agent's planning and execution steps.

experiment-plan