The Agent Skills Directory

[PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection because it reads and processes content from external, potentially untrusted source files.
Ingestion points: The procedure in SKILL.md explicitly instructs the agent to read files from the codebase to gather evidence.
Boundary markers: The instructions lack markers or delimiters to differentiate between code content and potential instructions embedded within the files.
Capability inventory: The agent possesses the ability to read arbitrary file content and synthesize it into a response, which could lead to the execution of instructions hidden in comments or documentation.
Sanitization: There is no evidence of sanitization, filtering, or validation of the file contents before they are processed by the agent.

wiki-qa