The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill exposes an indirect prompt injection vulnerability surface through the automated ingestion and processing of untrusted external content.
Ingestion points: Untrusted data enters the agent context through the $request argument (which accepts arbitrary tickets, URLs, or specifications) and via remote web text retrieved during execution of the browse skill in SKILL.md.
Boundary markers: There are no boundary markers, delimiters, or specific instructions instructing the model to ignore embedded prompts or commands contained within the fetched web pages or ticket descriptions.
Capability inventory: The skill configuration allows access to high-privilege capabilities including the Bash, Write, and Skill tools, which could be abused if an injection succeeds.
Sanitization: The instructions do not define any sanitization, filtering, escaping, or structural validation protocols for the external content before it is processed.

browse-qa