The Agent Skills Directory

[PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection. It ingests data from external sources (PDF, Word, and Excel files) and interpolates this content directly into reasoning prompts. A malicious document could contain hidden instructions designed to influence the 'Bottom-line recommendation' or obscure risks.
Ingestion points: Data enters the workflow through pdf_extract, docx_extract, xlsx_extract, and pasted_text_extract steps in SKILL.md.
Boundary markers: Absent. The skill lacks delimiters (such as XML tags or triple quotes) or specific system instructions to disregard embedded commands when processing extracted text in the risk_review and decision_brief steps.
Capability inventory: The skill is granted filesystem-read and filesystem-write permissions to inspect documents and spreadsheets.
Sanitization: While the initial user_message is escaped in the intake step, extracted document content is not sanitized or escaped before interpolation into subsequent LLM steps.
[COMMAND_EXECUTION]: The skill utilizes specialized internal sub-skills (pdf-toolkit, docx, and xlsx) to perform filesystem operations. These tools are used to read and process user-provided documents to extract text, tables, and metadata for analysis.

meta-document-to-decision