The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes external technical specifications provided via the argument. These files are ingested and used to generate debate topics and classification reports. Maliciously crafted content within these files could potentially influence the agent's reasoning or behavior.
Ingestion points: Specification files read in Phase A (references/phase-a-classify.md) and Phase B (references/phase-b-debate-topic.md).
Boundary markers: The templates for Claude and Codex do not include explicit instructions to disregard embedded commands or use unique delimiters for untrusted content.
Capability inventory: The skill has access to file system operations (Read, Write, Bash(node:*)) and MCP tool invocations.
Sanitization: The redact.js script provides post-processing redaction of output, but no pre-processing sanitization of input documents is performed to mitigate prompt injection.
[COMMAND_EXECUTION]: The workflow depends on several local Node.js scripts executed via Bash. The instructions require the agent to manually track and substitute absolute paths for temporary directories and security tokens. This manual path management, while accompanied by explicit safety warnings regarding macOS temporary directory handling, presents a surface for potential errors if paths are mishandled during substitution.

necessity-audit