The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill's primary function is to ingest and process external content from user-supplied file references and URLs, which creates a vulnerability surface for indirect prompt injection attacks.
Ingestion points: The agent is instructed to process references like @剧本初稿.docx or natural language references like "the latest uploaded file" in SKILL.md, and the scripts/file_reference.py script provides the logic to detect these.
Boundary markers: There are no instructions or delimiters defined in SKILL.md to help the agent distinguish between the skill's instructions and potentially malicious instructions embedded within the files being analyzed.
Capability inventory: The skill encourages the agent to extract key information and provide planning suggestions, which involves reading file content and potentially using tools like 'WebFetch' (as mentioned in references/examples.md) to access external URLs.
Sanitization: There is no evidence of content sanitization, filtering, or validation of the ingested data in either the instructions or the provided Python script.

file-reference