The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes content from several external files and treats them as authoritative constraints or instructions for the agent's behavior during a task. This creates a surface for indirect prompt injection if the content of these files is influenced by untrusted sources.
Ingestion points: The skill reads control/rules.md, control/approved_lessons/index.yaml, state/tasks/<task_id>/run_state.yaml, correction_journal.md, and state/lessonbook/inbox.md (via SKILL.md).
Boundary markers: There are no explicit delimiters or instructions provided to the agent to distinguish between legitimate constraints and potentially malicious instructions embedded within the processed data files.
Capability inventory: The skill performs local file read and write operations, including updating task state and journals.
Sanitization: No content validation or sanitization is performed on the data read from these files before they are surfaced as 'active constraints' for the agent's execution environment.

resume-context