The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill possesses an attack surface for indirect prompt injection by ingesting and processing untrusted markdown data from user-provided agent files.
Ingestion points: The skill uses the Read tool to load the content of AGENT.md files specified by the user via the $target argument.
Boundary markers: The instructions lack explicit boundary markers or "ignore embedded instructions" directives when interpolating the content of the target agent into the agent's context for analysis.
Capability inventory: The skill has the capability to write and edit files (using Write and Edit tools) based on its analysis of the untrusted input, specifically creating plan files in the .ulpi/plans/agents/ directory and modifying the source AGENT.md file.
Sanitization: There is no evidence of content validation, escaping, or filtering to prevent malicious instructions embedded in a target agent file from influencing the normalization process.

normalize-agent-for-claude