The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill's primary architecture involves reviewing and fixing content that may originate from untrusted sources or contains instructions that could influence the reviewer agents.
Ingestion points: The REVIEWER_PROMPT in SKILL.md interpolates {task_spec} and {output} directly into the prompt for sub-agents.
Boundary markers: The framework uses Markdown headers to separate data fields, which is a weak boundary that can be bypassed by adversarial content within the {output} variable.
Capability inventory: The skill utilizes the Agent tool to spawn sub-processes and a fix_agent loop, meaning a successful injection in the output could potentially manipulate the verification result or the subsequent fix cycle.
Sanitization: There is no implementation of escaping, validation, or explicit 'ignore instructions' guards for the content being processed by the reviewers.

santa-method