The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted user input in the form of a claim to be tested, which is then processed by multiple sub-agents.
Ingestion points: The 'original_claim' and 'normalized_claim' are interpolated into the assignments for the prove_it_lens and prove_it_oracle agents as described in the Core Contract of SKILL.md.
Boundary markers: The instructions do not specify the use of clear boundary markers (e.g., XML tags or specific delimiters) to isolate user-provided claims from the instructions for the sub-agents, creating a surface where a claim could potentially influence sub-agent logic.
Capability inventory: The skill orchestrates multiple sub-agent rounds. The oracle's final synthesized response is relayed directly to the user by the root coordinator, providing a potential delivery path for manipulated content.
Sanitization: While a normalization step is mentioned, the skill lacks detailed requirements for sanitizing or escaping the user claim before passing it to sub-agents.
[DYNAMIC_EXECUTION]: The skill package contains an executable Python script (tests/test_subagent_contract.py).
Description: The script uses pathlib and tomllib to inspect local skill and agent configuration files to ensure compliance with the skill's 'artifactless' state model.
Evidence: The script performs automated filesystem reads and content verification to enforce that no persistent state files are created during execution.
Risk: While the script is intended for development and testing, its presence within the skill structure constitutes a dynamic execution surface.

prove-it