The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and act upon untrusted data from external user-provided specifications or task tickets.
Ingestion points: The SKILL.md file instructs the agent to "Implement the work described by the user in the spec or tickets."
Boundary markers: The prompt lacks explicit boundary markers or instructions to treat the content of specs/tickets as data rather than instructions, which is a common surface for indirect prompt injection.
Capability inventory: The skill instructions involve executing tests, running typecheckers (likely involving shell access), and performing git operations (commits), providing a set of capabilities that could be targeted by an injection.
Sanitization: The instructions do not include any steps for the agent to validate, filter, or sanitize the incoming text from the user-provided documents before processing them.

implement