The Agent Skills Directory

[PROMPT_INJECTION]: The skill exhibits a surface for indirect prompt injection by processing untrusted data from AGENTS.md files.
Ingestion points: The skill retrieves agent frontmatter and body content via the agent_get tool from files located in ~/.treasure-work/agents/ or the workspace.
Boundary markers: The sub-agent prompt templates (e.g., in the 'Structure Check' and 'Quality Check' sections) interpolate the agent's frontmatter and body using simple placeholders like {paste frontmatter JSON} and {paste body} without using delimiters (such as XML tags or triple-backticks) or explicit instructions to ignore embedded commands.
Capability inventory: The skill possesses the ability to launch sub-tasks via TaskCreate and modify agent configurations using agent_update based on the review results.
Sanitization: No sanitization or escaping of the external agent content is performed before it is included in the sub-agent instructions. An attacker could potentially embed malicious instructions in an agent's body to influence the review outcome or trigger unauthorized agent_update calls.
[COMMAND_EXECUTION]: The skill utilizes administrative tools such as agent_get and agent_update to interact with agent definitions on the file system. While these are necessary for the skill's purpose (auditing and fixing agents), they represent high-privilege capabilities that should be guarded against misuse from the aforementioned injection risks.

agent-review