The Agent Skills Directory

[PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection as it ingests untrusted data from failure.html and failure.json. These artifacts are generated from the state of a web application during a failure. If the application is under an attacker's control, they could embed malicious instructions in the HTML (e.g., in hidden comments) or JSON error messages to manipulate the agent. Evidence chain:\n
Ingestion points: The skill reads failure.json, failure.html, events.json, and the .demo.yaml spec file.\n
Boundary markers: Absent. There are no instructions to use delimiters or ignore instructions found within these files.\n
Capability inventory: The skill has permissions for Write, Edit, and executing shell commands via Bash (specifically node, pnpm, and npx). It uses these to modify the spec file and run validation/execution scripts.\n
Sanitization: Absent. The instructions tell the agent to "Read" and "Parse" the content directly without validation.\n- [COMMAND_EXECUTION]: The skill provides the agent with Bash tool access restricted to node, pnpm, and npx. While these are limited, they can be used to execute the modified spec files. An attacker successful in an indirect prompt injection attack could trick the agent into writing malicious payloads into the spec files that are then executed during the validation or re-run steps.

heal-spec