The Agent Skills Directory

[PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection because it ingests untrusted data from the user and uses it to generate implementation roadmaps and strategies.
Ingestion points: Untrusted data is collected via the AskUserQuestion tool in SKILL.md (Phase 1: App Profile Collection), specifically the app name, description, and audience details.
Boundary markers: The instructions do not define delimiters (such as XML tags or unique markers) to isolate user-provided data from the agent's internal logic, increasing the risk that embedded instructions in an app description could be obeyed.
Capability inventory: The skill is authorized to use Write and Edit tools (defined in the allowed-tools frontmatter), which could be misused if an injection successfully overrides the agent's primary objective.
Sanitization: There is no requirement in the provided files for the agent to sanitize, validate, or escape the content of the app profile before processing it or including it in generated output.

marketing-strategy