The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill instructions direct the agent to ingest context from external files such as '.agents/product-marketing.md'. This creates a potential attack surface where malicious instructions could be embedded in these data files to influence the agent's behavior. 1. Ingestion points: The 'SKILL.md' file instructs the agent to read from '.agents/product-marketing.md', '.claude/product-marketing.md', or the legacy 'product-marketing-context.md' before starting tasks. 2. Boundary markers: No explicit delimiters or instructions to ignore embedded commands are present for the ingested file content. 3. Capability inventory: The skill provides advice and CRM automation recipes but does not contain scripts that perform direct shell command execution or network operations. 4. Sanitization: There is no evidence of validation or sanitization for the content of the external context files.

revops