Is it even prompt injection if the malicious instructions are in a file that is supposed to be read as instructions? Seems to me the direct takeaway is pretty

Is it even prompt injection if the malicious instructions are in a file that is supposed to be read as instructions? Seems to me the direct takeaway is pretty simple: Treat skill files as executable code; treat third-party skill files as third-party executable code, with all the usual security/trust implications. I think the more interesting problem would be if you can get prompt injections done in "data" files - e.g. can you hide prompt injections inside PDFs or API responses that Claude legitimately has to access to perform the task?