The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill has a surface for indirect prompt injection as it is designed to ingest and process data from chat history and subagent reports.
Ingestion points: SKILL.md instructs the agent to "Collect your own work since that message, reports from subagents, and messages from anyone else in this chat."
Boundary markers: The skill does not define explicit delimiters or boundary markers for the data it collects.
Capability inventory: The risk is mitigated by strict operational constraints defined in the instructions: "Keep this turn read-only: do not change code, start an app or a job, or post anything."
Sanitization: No sanitization or validation logic for the ingested content is specified.

ketchup