The Agent Skills Directory

[PROMPT_INJECTION]: The skill processes untrusted user data via the $ARGUMENTS placeholder in SKILL.md, which creates an indirect prompt injection surface.
Ingestion points: User-supplied input enters the agent context through the $ARGUMENTS variable located at the top of the SKILL.md file.
Boundary markers: The input is interpolated directly into the markdown body without any delimiters, such as XML tags or triple backticks, or instructions to ignore embedded commands.
Capability inventory: The skill frontmatter enables high-impact tools including Bash and Read, which allows the agent to execute shell commands and modify system state based on the interpolated instructions.
Sanitization: There is no evidence of input validation, escaping, or filtering to prevent malicious instructions within the arguments from influencing agent behavior.

chaos