The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and analyze external, untrusted skill files (SKILL.md, scripts, and references), which creates a surface for indirect prompt injection attacks.
Ingestion points: The audit, design, and refactor modes (defined in references/audit.md, references/refactor.md, and references/research.md) require the agent to read all files, references, and scripts of a target skill as a primary step.
Boundary markers: The instructions do not provide specific delimiters or "ignore embedded instructions" warnings to help the agent distinguish between its own operational instructions and the potentially adversarial instructions contained within the skills being analyzed.
Capability inventory: The skill possesses the ability to read files, perform environment-wide file searches, and generate proposed code changes (refactors) for user approval. Additionally, references/research.md instructs the agent to "run the command" or "call the API" to verify claims found in the target skill, which could lead to unintended code execution if the target skill provides malicious validation commands.
Sanitization: There is no evidence of sanitization, escaping, or filtering of the content being audited before it is processed by the agent's logic.

skill-design