The Agent Skills Directory

[PROMPT_INJECTION]: The skill implements a self-referential feedback loop that is vulnerable to persistent indirect prompt injection. In Step 1, the agent is instructed to read references/learnings.md for context, and in Step 4, it is told to append new tips or 'gotchas' to that same file. A malicious user could provide a 'tip' that contains instructions to override the agent's core behavior, which would then be automatically loaded and followed in all subsequent sessions.
Ingestion points: The references/learnings.md file and user interaction prompts.
Boundary markers: There are no delimiters or instructions to ignore embedded commands within the learnings file.
Capability inventory: The skill is designed for an environment where the agent likely has file system access (to read/write the learnings file) and potentially shell access to help users with API integrations.
Sanitization: The skill lacks any mechanism to validate, escape, or sanitize the user-provided 'gotchas' before they are stored as authoritative context.

sales-samcart