The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes external data from CSV files, which is an inherent attack surface for indirect prompt injection in agentic workflows.
Ingestion points: Untrusted data enters the agent context through the reading of CSV files (e.g., data/ratings.csv, data/items.csv, data/transactions.csv) in files like scripts/svd_basic.py and scripts/evaluate_top_k.py.
Boundary markers: There are no explicit delimiters or instructions to the agent to ignore embedded commands within the data being processed.
Capability inventory: The skill possesses capabilities including local shell execution via bash_tool and network access through web_search.
Sanitization: The scripts use standard library functions like pandas.read_csv but do not implement specific sanitization or filtering of the content before presenting summaries or samples to the agent.
[PROMPT_INJECTION]: No direct attempts to override system instructions, bypass safety filters, or extract system prompts were detected in the skill instructions or metadata.
[DATA_EXFILTRATION]: No evidence of hardcoded credentials, sensitive file access (e.g., SSH keys, AWS configs), or unauthorized network exfiltration was found. The skill uses web_search for industry benchmarks, which is consistent with its stated purpose.
[OBFUSCATION]: All scripts and instructions are provided in plain text. No Base64, zero-width characters, or other encoding techniques were used to hide malicious logic.
[COMMAND_EXECUTION]: The skill executes local Python scripts to perform mathematical modeling. These scripts use well-known libraries like numpy and pandas and do not involve dangerous patterns such as eval() on untrusted input or arbitrary subprocess spawning.

recommender-systems