The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes user-supplied file references and URLs, creating an attack surface where malicious instructions embedded in those external sources could influence agent behavior.
Ingestion points: scripts/file_reference.py and SKILL.md define mechanisms to detect and resolve references to local files and external URLs (e.g., @file://, @url://).
Boundary markers: The skill does not instruct the agent to use specific delimiters or protective framing when processing retrieved data to distinguish between data and instructions.
Capability inventory: The skill is explicitly granted Read access in the frontmatter, and its documentation suggests using tools like WebFetch to retrieve and analyze external content.
Sanitization: There is no evidence of sanitization, validation, or escaping of the content extracted from external sources in the provided Python script or markdown instructions.

file-reference