The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and analyze untrusted external data such as project plans, architecture documents, or source code files during its setup phase.
Ingestion points: Phase 1 instructions ('Set the Failure Frame') explicitly direct the agent to use tools like Read, Grep, and Glob to gather context from project-related artifacts provided by the user.
Boundary markers: The instructions do not specify the use of delimiters or 'ignore' instructions to isolate analyzed content from the agent's core instructions.
Capability inventory: The skill's frontmatter configuration allows the use of the Bash and Agent tools. If a processed file contains malicious instructions (e.g., hidden in a project plan or comment), the agent might attempt to execute them using these tools.
Sanitization: There is no mention of sanitizing, escaping, or validating the content read from external files before it is processed by the LLM.

swing-mortem