The Agent Skills Directory

[PROMPT_INJECTION]: The skill is vulnerable to Indirect Prompt Injection because it ingests untrusted data and interpolates it into the execution flow without proper sanitization.
Ingestion points: The variable {{args}} in SKILL.md directly accepts user-provided input.
Boundary markers: No delimiters (e.g., XML tags or backticks) or instructions to ignore embedded commands are used when processing {{args}}.
Capability inventory: The skill allows access to powerful tools including Bash, Write, Edit, and WebFetch as defined in the allowed-tools metadata.
Sanitization: There is no evidence of input validation, escaping, or filtering of the {{args}} content before it is passed to subsequent tools or sub-skills.

flux