The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill's operation involves processing data from the local project environment which may contain untrusted content.
Ingestion points: The skill reads config/routes.rb and executes bin/rails routes to inspect the application state, both of which are sources of data that could be influenced by external contributors.
Boundary markers: The instructions lack specific delimiters or guidance to help the agent ignore or isolate instructions that might be embedded within route names, comments, or metadata in the files it reads.
Capability inventory: The agent has access to Write, Edit, and Bash tools, providing a mechanism for an injection to result in unauthorized file modifications or command executions if the agent is successfully manipulated.
Sanitization: There are no verification or sanitization steps implemented to validate the content of the routing files or command outputs before they are processed by the agent.

routing