The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted user input via the $ARGUMENTS variable and interpolates it directly into the prompt context.
Ingestion points: The $ARGUMENTS placeholder in references/prompt-command.md receives direct input from the user.
Boundary markers: There are no boundary markers or delimiters (such as XML tags or special characters) used to separate the user-provided arguments from the system's core instructions, increasing the risk that malicious input could override the intended behavior.
Capability inventory: The skill possesses capabilities to read local files (e.g., skills/image-prompt-guide/references/full.md) and write new files (e.g., slide-prompt-*.md), which could be abused if an injection is successful.
Sanitization: No sanitization, validation, or escaping logic is applied to the input before it is used in the prompt construction.
[COMMAND_EXECUTION]: The skill instructions specify the execution of local scripts for the purpose of validating generated prompts.
Evidence: The file references/prompt-command.md mentions that scripts/prompt-output-gate.mjs and skills/image-prompt-kit/scripts/check_prompt.mjs are used to perform machine judgment and validation of the skill's output.

prompt