The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill interpolates untrusted user data into prompts sent to sub-agents, which could allow an attacker to influence agent behavior through the input data.
Ingestion points: User-provided strings for $ARGUMENTS (used in Steps 1b, 2, and 8) and input gathered via <get from user> (Step 4) are placed directly into the prompts for fpf-agent instances.
Boundary markers: There are no delimiters (such as XML tags or triple quotes) or specific instructions for the agent to treat the user input as passive data rather than instructions.
Capability inventory: The workflow utilizes sub-agents with the ability to read/write files and execute task-specific logic from local markdown files. The main agent has shell execution capabilities.
Sanitization: The skill does not perform any validation, filtering, or escaping of the user-supplied input before interpolation.
[COMMAND_EXECUTION]: The skill uses shell commands to manage the local environment.
Evidence: Step 1a utilizes mkdir -p and touch to initialize a hidden directory structure (.fpf/) used to maintain the framework's state. While these specific commands are benign, they demonstrate that the skill environment supports shell command execution.

propose-hypotheses