The Agent Skills Directory

[PROMPT_INJECTION]: The skill exhibits a surface for indirect prompt injection by processing untrusted data.
Ingestion points: Untrusted data enters the agent context via the artifact and causal_claims inputs in SKILL.md and prompt.md.
Boundary markers: The prompt does not use delimiters (such as XML tags or unique markers) to isolate the untrusted artifact content from the system instructions.
Capability inventory: The skill is executed via spawn-agent, which is noted to have access to MCP tools, providing a potential execution path for instructions hidden within the input data.
Sanitization: There is no logic present to sanitize, escape, or validate the content of the artifact before it is processed by the LLM.

factor-enumeration