The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill reads and processes external text files (.txt recordings) for semantic analysis and keyword extraction. These files represent untrusted input that could contain malicious instructions.
Ingestion points: User-specified file path provided to the analysis workflow in SKILL.md.
Boundary markers: None; the skill does not define delimiters or provide instructions to ignore commands within the analyzed text.
Capability inventory: The agent has access to Bash, Grep, Read, and AskUserQuestion tools during execution.
Sanitization: No mechanisms for escaping or validating the content of the text files are described.
[PERSISTENCE]: The skill implements a self-modification pattern labeled as "Self-Evolving Skill."
Evidence: The instructions in SKILL.md (specifically the "Self-Evolving Skill" and "Post-Execution Reflection" headers) explicitly direct the agent to rewrite the skill's source files to fix issues or update parameters. This capability could be exploited by an attacker providing a malicious recording that triggers a "workaround" the agent then persists into the skill instructions.

analyze