The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted user input which is interpolated into the agent's main prompt.
Ingestion points: The agents/openai.yaml file uses the $ARGUMENTS placeholder to incorporate user input directly into the default_prompt.
Boundary markers: There are no delimiters (e.g., XML tags, triple quotes) or specific instructions to isolate the user input from the system instructions.
Capability inventory: According to SKILL.md, the skill is authorized to make scoped changes to the repository and execute verification commands, which provides a path for malicious input to affect the local environment.
Sanitization: No input validation, escaping, or filtering is applied to the data passed through the $ARGUMENTS variable.

ork-implement