The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted user-supplied novel text and has the capability to modify files via the narrative-writer subagent and local scripts. The prompt template used to invoke the subagent interpolates the user-controlled story content without clear boundary markers or instructions to ignore embedded commands, creating a risk that malicious instructions within a story could influence the agent's actions.
Ingestion points: SKILL.md (Phase 3 and 4) identifies that the skill reads and processes user-provided novel chapters from the project directory.
Boundary markers: The prompt template for the narrative-writer subagent in SKILL.md lacks delimiters (e.g., XML tags or unique markers) to isolate the untrusted story text from the system instructions.
Capability inventory: The skill possesses the capability to write and modify files in the project directory using platform tools (Edit/Write) and executes several local scripts (check-ai-patterns.js, check-degeneration.js, normalize-punctuation.js, author_memory_commit.py) using node and python subprocess calls.
Sanitization: No sanitization or escaping of the user-provided story content is performed before it is passed to the AI models for rewriting, relying entirely on the model's internal safety guardrails.

story-deslop