The Agent Skills Directory

[PROMPT_INJECTION]: The skill accepts user-supplied arguments (--format, --audience, --sections) and interpolates them directly into the system prompt for a spawned subagent. While the skill attempts to sanitize this input by truncating it to 200 characters and stripping backticks and angle brackets, this does not prevent an attacker from providing natural language instructions designed to override the subagent's behavior.
[COMMAND_EXECUTION]: The skill utilizes the Bash tool to resolve directory paths via a jq command. The implementation correctly uses the --arg flag to pass variables to jq, which prevents shell injection from the $TOPIC_SLUG variable. However, it remains a point where file system metadata and external JSON data influence command-line execution parameters.
[PROMPT_INJECTION]: The skill presents an indirect prompt injection surface by ingesting data from research state files (state.json) and using it to drive orchestration and subagent parameters.
Ingestion points: The skill reads the topic_slug from ./reports/*/state.json and parses user input from $ARGUMENTS.
Boundary markers: The subagent prompt in Phase 1 lacks explicit delimiters (e.g., XML tags or triple quotes with 'ignore' instructions) to isolate the untrusted parameters from the agent's core instructions.
Capability inventory: The skill has access to powerful tools including Bash, Write, and Agent (for spawning sub-agents).
Sanitization: The skill implements basic validation of the topic_slug (checking for non-empty string and status) and character-based stripping for arguments, but lacks robust sanitization for complex prompt injection payloads.

report