The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and analyze external, potentially untrusted application code and configuration files, which introduces a risk of indirect prompt injection.
Ingestion points: The SKILL.md file instructs the agent to "Review authorized application code, configuration, designs or artifacts," which are provided at runtime.
Boundary markers: There are no specific instructions or delimiters provided to help the agent distinguish between its core instructions and instructions that may be maliciously embedded in the code being reviewed.
Capability inventory: The skill frontmatter does not restrict tools, meaning the agent processes external content while possessing the host environment's full toolset (e.g., file system access, shell execution).
Sanitization: The instructions do not define any sanitization, filtering, or escaping protocols for the content being analyzed.

security-review