The Agent Skills Directory

[Indirect Prompt Injection] (HIGH): The skill implements a 'files-as-state' architecture where the agent interacts with structured text files using read_file and write_file tools.
Ingestion points: The agent is designed to read ROOM.yml, CHARACTER.yml, and SESSION.md as its primary input substrate.
Boundary markers: The skill lacks any definition for delimiters or boundary markers to distinguish between data and instructions within these text files.
Capability inventory: The YAML frontmatter explicitly authorizes read_file and write_file operations across the filesystem.
Sanitization: No sanitization or validation logic is mentioned. An attacker who can influence the content of a .yml or .md file (e.g., through a character description or room note) can inject instructions that the agent may execute with its file-writing privileges.

plain-text