The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill's primary function is to process untrusted data from chat history and subagent reports, creating an indirect prompt injection surface.
Ingestion points: Processes all chat messages and subagent outputs generated since the user's last message (SKILL.md).
Boundary markers: The instructions do not specify the use of delimiters or boundary markers to distinguish between system instructions and the ingested chat data.
Capability inventory: The skill's ability to take sensitive actions is limited by the disable-model-invocation: true configuration in the frontmatter.
Sanitization: No explicit instructions are provided for sanitizing or escaping the content retrieved from the chat history or subagent reports.

ketchup