The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is designed to manage and evaluate prompt assets (e.g., roles, rules, and workflows) stored in various project files. These files represent an attack surface where malicious instructions could be embedded and subsequently processed by the agent during evaluation or promotion stages.
Ingestion points: The skill reads prompt definitions from multiple locations including roles/*.md, rules/*.md, workflows/*.md, and skills/*/SKILL.md.
Boundary markers: The skill instructions do not mandate the use of delimiters (like XML tags or clear-text separators) or specific "ignore embedded instructions" warnings when loading the content of these files for evaluation.
Capability inventory: The skill is configured with powerful capabilities including execute_command, write_file, and edit_file, which could be exploited if an injected instruction is followed by the agent during the prompt lifecycle workflow.
Sanitization: There is no mention of content filtering, escaping, or structural validation of the prompt body itself before it is passed to evaluation tools or LLM-as-a-judge scorers.

agent-prompt-lifecycle