The Agent Skills Directory

[PROMPT_INJECTION]: The skill exhibits an indirect prompt injection vulnerability surface within its multi-agent orchestration logic.
Ingestion points: The SKILL.md file defines a Task Prompt Template used in Phase 1 that interpolates the context_summary, scope, and domains parameters directly from the caller-provided debate_input.
Boundary markers: While the template uses markdown headers (e.g., ## Phase 1: Independent Investigation) to provide structure, it lacks explicit delimitation or instructions to the LLM to ignore or escape instructions contained within the interpolated variables.
Capability inventory: The skill spawns sub-agents with access to the Read, Write, Task, and Bash tools, creating a risk of unauthorized actions if a sub-agent follows instructions injected via the scope or context_summary fields.
Sanitization: There is no evidence of input validation, sanitization, or escaping for the strings processed by the prompt template.
[COMMAND_EXECUTION]: The skill includes instructions to execute shell commands that exceed the specifically defined tool restrictions.
Evidence: In SKILL.md, the allowed-tools section restricts Bash to mkdir *. However, the Phase 5 and Execution Instructions sections include commands for ls -t and qmd collection add. While these specific tools are for local file management and are not inherently malicious, their inclusion in the instructions suggests the agent may attempt to bypass the restricted tool manifest.

debate-protocol