The Agent Skills Directory

[PROMPT_INJECTION]: The skill implements an indirect prompt injection surface by reading from and writing to references/learnings.md. This allows potentially untrusted data from user sessions to be stored and subsequently influence the agent's behavior in future invocations. Ingestion points: The file references/learnings.md is read at the beginning of Step 1 to provide accumulated knowledge. Boundary markers: There are no instructions or delimiters provided to ensure the agent ignores or sanitizes any potentially malicious instructions found within the learnings file. Capability inventory: The skill performs file reading and appending operations across its reference files; no advanced tools like network access or shell execution are requested in the skill configuration. Sanitization: The skill lacks logic to validate or escape the content it appends to the learnings file, allowing for the persistence of arbitrary text.

sales-mailman