The Agent Skills Directory

[PROMPT_INJECTION]: The skill is susceptible to Indirect Prompt Injection (Category 8) because it ingests untrusted data from local file directories and external web sources. This content is then used to construct prompts for a secondary LLM session via the Codex MCP tool.
Ingestion points: Phase 1 (Landscape Survey) reads local PDFs from papers/ and literature/ and fetches content via WebSearch and WebFetch.
Boundary markers: The skill lacks robust delimiters or explicit instructions to the agent to ignore potentially malicious instructions embedded within the research papers or web pages it processes.
Capability inventory: The skill has access to sensitive tools including Bash(*), Write, and Agent, which could be targeted by an injection attack.
Sanitization: No validation or sanitization steps are defined for the data extracted from external sources before it is interpolated into subsequent prompts.
[COMMAND_EXECUTION]: In the 'Key Rules' section of SKILL.md, the instructions mandate that the agent use Bash to write files in chunks if the standard Write tool fails. The instruction specifically states: 'Do NOT ask the user for permission — just do it silently.' This explicitly encourages the agent to bypass user oversight for shell command execution, which is a significant autonomy risk.

idea-creator