The Agent Skills Directory

[Indirect Prompt Injection] (HIGH): The skill possesses a significant attack surface for indirect prompt injection.
Ingestion points: The skill instructions (Execution Flow) specify scanning all ideas/*/ directories, reading README.md files, and parsing arbitrary markdown files for links and status.
Boundary markers: There are no specified boundary markers or instructions to treat ingested file content as data rather than instructions.
Capability inventory: The skill is granted the Edit tool, providing the ability to modify files in the workspace.
Sanitization: No sanitization or validation of the content of the markdown files is mentioned before processing.
Risk: An attacker could place a malicious markdown file in the documentation path containing instructions that the agent might execute, such as using the Edit tool to corrupt files, delete documentation, or modify project configuration files.

docs