The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted content from user-specified artifacts and referenced files, passing it directly to multiple sub-agents for analysis.
Ingestion points: Artifact content from the $ARGUMENTS input and recursively read referenced files (schema, service, config) as defined in Step 1 of SKILL.md.
Boundary markers: Absent. The sub-agent prompts in SKILL.md interpolate ARTIFACT_CONTENT directly without delimiters or explicit instructions for the agents to ignore embedded commands or instructions.
Capability inventory: The orchestrator is granted Bash and Agent tools. The sub-agents are prompted to use Read, Grep, and Glob tools. This combination allows for significant system interaction if an agent is successfully subverted.
Sanitization: None detected. The orchestrator is instructed to report findings verbatim from the sub-agents, meaning any malicious output generated by a compromised sub-agent would be presented to the user.

friction-review