The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from a local writing material library, which could contain hidden instructions designed to manipulate the agent when the content is retrieved and displayed.
Ingestion points: Data is ingested from ./writing-workspace/materials/index.jsonl and content files located in ./writing-workspace/materials/entries/.
Boundary markers: The skill uses markdown blockquotes (>) to wrap the retrieved content, which is a weak boundary that may not prevent an LLM from following instructions embedded in the text.
Capability inventory: The skill has the capability to read any file within the specified materials directory in the local workspace.
Sanitization: There is no evidence of sanitization, filtering, or specific system instructions to ignore embedded commands within the retrieved materials.

material-retrieve