The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes external, untrusted reviewer letters that could contain instructions designed to manipulate the behavior of the supervisor or specialist sub-agents.
Ingestion points: In phases/01-parse-letter.md, the skill reads content from a user-specified <review-letter-path>, which may be sourced from external reviewers.
Boundary markers: While agent briefs in phases 02, 03, and 05 use text labels like "Comment text (verbatim):" to frame untrusted content, they lack robust delimiters or explicit directives for the model to ignore any embedded commands within that content.
Capability inventory: Dispatched agents have the capability to modify manuscript files (e.g., paper-writer in phase 03), and the skill itself performs multiple automated file writes and updates to project state files in phases/06-finalize.md.
Sanitization: No sanitization, validation, or instruction-filtering is performed on the letter content before it is interpolated into prompts for various sub-agents.

respond-reviewer