The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process user-supplied strings as input to be rewritten. A maliciously crafted input prompt could attempt to influence the agent's behavior during the refinement process to generate harmful outputs or leak context.
Ingestion points: Untrusted data enters the agent context via the <prompt to polish> argument hint in SKILL.md.
Boundary markers: The instructions do not use specific delimiters (e.g., XML tags or triple quotes) to separate the untrusted input from the agent's core instructions, increasing the risk of instruction leakage.
Capability inventory: The skill uses disable-model-invocation: true in its frontmatter, which prevents the model from calling secondary tools or performing actions during this specific execution phase, significantly reducing the blast radius of any injection.
Sanitization: There is no evidence of input validation, filtering, or escaping of the user-provided prompt before it is integrated into the agent's reasoning process.

ambitious-prompt