The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from the local filesystem and user-defined tasks, creating a surface for indirect prompt injection attacks.
Ingestion points: The docs tool reads file content from arbitrary local paths provided in the path parameter (e.g., during create or refresh actions). The tasks tool processes user-supplied titles, descriptions, and acceptance criteria.
Boundary markers: The skill instructions do not define specific delimiters or "ignore instructions" directives for the data retrieved from the docs registry or task metadata.
Capability inventory: While the skill itself manages metadata in a SQLite database, it orchestrates 'Worker' agents by defining their personas and goals, and provides them with task packets containing the ingested data. The agent also has the ability to write to the document registry and attach media files from the filesystem.
Sanitization: There is no mention of sanitization, validation, or escaping of the content ingested from external documents or task fields before it is presented to the agent context.

zenfd-tools