The Agent Skills Directory

[PROMPT_INJECTION]: The file SKILL.md contains a section titled 'Manual Instructions in AGENTS.md' that uses an override directive. It instructs the agent to treat content loaded via file references as 'mandatory instructions' and to 'follow references recursively.' The use of 'CRITICAL:' as a prefix for behavioral overrides is a pattern intended to bypass standard instruction processing priorities.
[INDIRECT_PROMPT_INJECTION]: The skill establishes an attack surface where untrusted data from the filesystem or network can influence agent behavior.
Ingestion points: The agent is configured to ingest instructions from AGENTS.md, CLAUDE.md, and any files or globs specified in the instructions array of opencode.json (e.g., packages/*/AGENTS.md).
Capability inventory: The documentation explicitly directs the agent to use its Read tool to load these files and follow recursive references.
Boundary markers: There is no evidence of boundary markers or instructions to ignore nested directives within the ingested files in the provided documentation or examples.
Sanitization: The documentation provides no guidance on sanitizing or validating the content of external instruction files before they are processed by the LLM.
[EXTERNAL_DOWNLOADS]: The documentation describes a feature for fetching rules from external sources, providing examples such as https://raw.githubusercontent.com/my-org/shared-rules/main/style.md. While the examples target well-known services, the mechanism allows the agent to download and interpret arbitrary remote content as behavioral constraints.

rules-creation