The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted external data to perform brand audits and voice extraction, which presents an attack surface for indirect prompt injection.
Ingestion points: The skill is designed to crawl external URLs and analyze user-provided text samples (such as website copy, social media posts, and emails) as defined in references/voice-building-sop.md (Mode 4: Auto-Scrape) and references/brand-audit-toolkit.md (Section 1.1: Audit Material).
Boundary markers: The instructions lack explicit requirements for the agent to use delimiters or specific safety warnings (e.g., "ignore embedded instructions") when processing the scraped or provided external text.
Capability inventory: The skill has the capability to write and overwrite files within the brand-brain/ directory and append data to a shared learnings.jsonl file (as noted in SKILL.md, Section 7.1). This could allow for persistent context poisoning if the agent follows malicious instructions embedded in the external content.
Sanitization: There are no documented procedures for sanitizing, escaping, or filtering external content before it is interpolated into the agent's context for analysis.

afa-brand