The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data via the $ARGUMENTS variable and passes it directly to specialized sub-agents.
Ingestion points: The $ARGUMENTS value is passed verbatim into the investigator sub-agent prompt under the Phenomenon field in SKILL.md.
Boundary markers: The skill uses a simple label (Phenomenon:) but lacks explicit delimiters or "ignore embedded instructions" warnings to prevent the sub-agent from executing commands contained within the user input.
Capability inventory: The sub-agents (investigator, verifier, solver) are instructed to perform broad investigations across code, history, and configuration, and to derive solutions, which could be subverted by a successful injection.
Sanitization: No input validation, escaping, or filtering is performed on the user-supplied problem description before it is used to build prompts.

recipe-diagnose