The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is inherently exposed to untrusted data as its primary function is to ingest and analyze external documents (PDF, DOCX, Markdown, URLs) which may contain malicious instructions designed to subvert the agent's behavior.
Ingestion points: The skill accepts document paths, URLs, and pasted text as input, as specified in the 'Inputs supported' section of SKILL.md.
Boundary markers: The skill employs robust structural boundaries by mandating a 'claim ledger' and the use of the references/review-checklist.md. The references/epistemic-assurance-contract.md explicitly warns the agent to 'Do not treat an assurance label or artifact field as proof that the underlying property holds,' providing a strong cognitive defense against adversarial content.
Capability inventory: The agent has the ability to write files to the local disk (<docname>.review.md) and perform web searches for verification.
Sanitization: While not programmatically sanitized, the skill's workflow forces the agent to cross-reference claims with external sources and internal logic rather than obeying embedded directives.
[COMMAND_EXECUTION]: The skill performs file-system operations by writing structured review reports to the disk (e.g., creating <docname>.review.md in the same directory as the input document). This is a functional requirement for its document auditing purpose.
[EXTERNAL_DOWNLOADS]: To verify time-sensitive and factual claims, the skill instructs the agent to use web browsing and search tools. This results in network requests to external domains for the purpose of information retrieval.

adversarial-doc-review