The Agent Skills Directory

[PROMPT_INJECTION]: The skill is designed to receive critical parameters such as creative direction, messaging briefs, and brand guidelines from an external orchestrator skill ("multi-channel-ad-ideation"). There are no defined boundary markers or instructions to ignore instructions embedded within this external data.
Ingestion points: The skill accepts Creative Direction, Creative Brief, Target Segment, and Brand Guidelines as external context (SKILL.md).
Boundary markers: Absent. The instructions do not specify any delimiters or safety warnings for the agent to distinguish between instructions and ingested data.
Capability inventory: The agent has access to the Read tool, Write tool, and the mcp__tdx-studio__open_file command execution tool (SKILL.md).
Sanitization: Absent. There is no requirement to validate or filter the content provided by the orchestrator skill.
[DATA_EXFILTRATION]: The skill instructions create a primitive for arbitrary file reading and data exposure. It specifically directs the agent to read file paths provided in the external Brand Guidelines or user parameters, base64-encode the content, and embed it in an HTML file.
Evidence: The "Logo embedding workflow" in SKILL.md explicitly instructs: "1. User provides logo path... 2. Read logo file using the Read tool... 3. Convert to base64... 4. Embed in email header".
Risk: If the delegated context or the user provides a path to a sensitive file (e.g., ~/.aws/credentials, .env, or SSH keys), the skill will read that file and expose its content as a base64 string within a rendered HTML preview.
[COMMAND_EXECUTION]: The skill enforces an automated workflow that writes generated content to the local file system and immediately executes a tool to open it.
Evidence: SKILL.md requires the agent to "save HTML to file: email-preview-{timestamp}.html" and "Immediately call mcp__tdx-studio__open_file with the absolute file path".
Risk: This automated execution of the "open" command on a file created from potentially tainted external input significantly increases the impact of path manipulation or indirect injection attacks.

email