The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill provides an interface to read file contents, which serves as an ingestion point for potentially untrusted data that can influence agent behavior.
Ingestion points: The workspace_read_file tool in handler.ts reads text content from files in the workspace and returns it to the agent context.
Boundary markers: The skill does not provide explicit boundary markers or instructions to the agent to treat file content as data rather than instructions.
Capability inventory: The skill possesses significant capabilities for modifying the file system, including workspace_write_file, workspace_delete_file, and workspace_rename_project, which could be abused if an injection attack is successful.
Sanitization: While path sanitization is performed in handler.ts to remove characters commonly used in shell injection and path traversal (e.g., {, }, %, ;, $), the actual content of the files is not sanitized or escaped.

workspace-files