The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill possesses a potential attack surface for indirect prompt injection due to its core function of ingesting and acting upon data from external agent runs and artifact contents.
Ingestion points: Data enters the agent's context through output from commands such as ae-cli team +run-result, ae-cli team +run-artifacts, and ae-cli team +run-watch (referenced in SKILL.md, references/run-result.md, references/run-artifacts.md, and references/run-watch.md).
Boundary markers: The instructions do not define strict delimiters or "ignore instructions" wrappers when interpolating external run outputs into subsequent prompts, instead directing the agent to process data verbatim.
Capability inventory: The skill has significant capabilities to execute shell commands via the ae-cli tool, including starting new runs, updating team configurations, and deleting resources (SKILL.md, references/create.md, references/delete.md).
Sanitization: There are no explicit sanitization or validation steps described for data retrieved from the engine before it is used in multi-turn logic or presented to the user.

ae-team