The Agent Skills Directory

[PROMPT_INJECTION]: The skill instructs the host model to identify its current system prompt state (targeting leaked GPT 5.6 snapshots) and provides a 'delta map' to 'override' specific instructions. While it claims to defer to native safety constraints, the direct instruction to modify operational behaviors by replacing or ignoring internal system prompt instructions constitutes a behavioral prompt injection pattern.- [EXTERNAL_DOWNLOADS]: The skill references an external GitHub repository (asgeirtj/system_prompts_leaks) that is not identified as a trusted or well-known vendor. This repository is used to provide the model with leaked instruction sets, creating a dependency on unverified external content.- [PROMPT_INJECTION]: The references/trust-boundaries.md documentation contains known injection trigger phrases such as 'ignore previous instructions'. Although these are intended as defensive examples to teach the model how to classify such strings as inert data, their inclusion may trigger automated safety detections or be misused by an attacker.- [SAFE]: The skill provides robust security hardening doctrines, including an 'Irreversibility Gate' (references/irreversibility.md) and 'Trust Boundaries' (references/trust-boundaries.md). These modules explicitly define protocols for user authorization before destructive actions and source classification to prevent data-to-instruction promotion.- [PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection through the ingestion of external content.
Ingestion points: Fetched web pages, emails, tickets, tool results, and subagent reports as documented in references/trust-boundaries.md.
Boundary markers: The 'Trust Boundaries' doctrine requires the agent to classify content by source and treat external text as inert data rather than instructions, providing a structural defense.
Capability inventory: The agent has capabilities for parallel tool dispatch, subagent delegation, file system writes, and memory management.
Sanitization: The skill requires that any actions requested by untrusted data be surfaced to the user as findings and mandates explicit user authorization through an 'Irreversibility Gate' before execution.

fable-mode