The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill implements a Retrieval-Augmented Generation (RAG) workflow that is inherently vulnerable to indirect prompt injection. Specifically, the add_chunk_context function in SKILL.md interpolates raw, untrusted document content (full_document and chunk) directly into an LLM prompt. This creates a vector where malicious instructions embedded in a processed document could override the agent's behavior during the contextual retrieval phase.
Ingestion points: Untrusted data enters the agent context via the full_document and chunk variables used in the context_prompt template within SKILL.md and RESEARCH-SUMMARY.md.
Boundary markers: The implementation uses minimal XML-style tags (<document>, <chunk>) to delimit data, but lacks explicit system instructions or guardrails advising the model to ignore potentially malicious commands within that data.
Capability inventory: The skill is granted access to high-privilege tools including Bash, Write, Edit, and WebFetch, which could be abused if an injection attack succeeds.
Sanitization: No sanitization, escaping, or validation of the external document content is performed before it is interpolated into the prompt.

citations-retrieval