The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest conversation history (untrusted data) and write it into persistent HTML or Markdown files.
Ingestion points: Recent conversation content, including research results, design plans, and procedures, is used to generate the document content and the topic-based filename (SKILL.md).
Boundary markers: The instructions do not include boundary markers or warnings to ignore embedded instructions within the conversation data being processed.
Capability inventory: The skill is granted access to the Write tool for file creation and the Bash tool for executing external utilities.
Sanitization: The instructions emphasize formatting for readability (headings, tables, CSS) but do not specify any sanitization, escaping, or filtering to prevent malicious code (such as XSS) from being included in the exported files.
[COMMAND_EXECUTION]: The skill instructs the agent to use the Bash tool to invoke the grip utility for rendering Markdown files.
Pattern: Direct use of shell execution via Bash to open files generated from conversation context.
Context: While the instruction to use kebab-case for filenames acts as a basic mitigation, the execution of commands on files whose content and names are influenced by the conversation creates a surface for potential injection if the agent does not strictly follow formatting rules.

export