The Agent Skills Directory

[PROMPT_INJECTION]: The skill contains multiple examples of prompt templates that interpolate untrusted external data (such as {user_input}, {code}, {problem}, and {auth_code}) directly into instructions for the LLM. This pattern is vulnerable to indirect prompt injection, where malicious instructions hidden in the data could override the agent's primary goals.
Ingestion points: Variable placeholders throughout SKILL.md used for processing user-supplied code, problems, and stories.
Boundary markers: The skill documentation suggests using XML tags (e.g., <user_story>, <codebase>) to provide structure, which helps the LLM distinguish data from instructions but does not guarantee prevention of injection attacks.
Capability inventory: The skill is designed for an environment where the agent has access to sensitive tools such as Bash, Write, and Edit, increasing the potential risk of a successful injection.
Sanitization: There is no evidence of input validation, escaping, or sanitization logic within the provided code snippets to mitigate the risk of embedded commands in the interpolated variables.

llmintegration