The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is designed to process and review user-generated content and mixed-direction text (e.g., Arabic, Hebrew) within web templates and rendered HTML. This creates an ingestion surface where an attacker could embed malicious instructions in the text being reviewed by the agent.
Ingestion points: The SKILL.md file instructs the agent to "Verify user-generated inline text" and "Review templates... that output markup".
Boundary markers: None observed in the instructions to separate untrusted content from the agent's logic.
Capability inventory: The skill includes instructions for code review and markup validation, though no active subprocess or network capabilities are defined in the skill files themselves.
Sanitization: The skill provides guidance on using dir="auto" and <bdi> for browser rendering but does not include sanitization instructions for the agent's internal processing of that content.
[DYNAMIC_EXECUTION]: The framework examples in references/rule.md demonstrate the use of v-html in a Vue.js component (<p v-html="post.content"></p>). This directive renders raw HTML and is a common source of Cross-Site Scripting (XSS) vulnerabilities if the content is not properly sanitized before rendering.

direction-attribute