The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted DICOM files which could contain malicious instructions embedded in metadata tags (indirect injection surface).
Ingestion points: The scripts/main.py script reads and processes DICOM files using the pydicom library.
Boundary markers: The skill instructions provide scope boundaries for the agent, but do not specify delimiters or instructions to ignore embedded commands within the image metadata tags.
Capability inventory: The skill can read/write files to the local file system and generate JSON audit logs via main.py.
Sanitization: The script clears or hashes specific PHI-related tags, but preserves many other metadata tags without specific sanitization against instruction confusion.
[INDIRECT_PROMPT_INJECTION]: The skill package includes a file dicom-anonymizer_audit_result_v2.json which contains self-certified safety claims (e.g., 'Security: PASS', 'grade: Production Ready').
Ingestion points: This file is part of the skill's reference context.
Boundary markers: Absent for this specific file.
Capability inventory: Not applicable; this is a self-referential document.
Sanitization: These claims are treated as data by the analyzer and should not be considered authoritative conclusions.
[METADATA_POISONING]: The file references/phi_tags.json is mislabeled as a JSON file but contains invalid syntax for that format.
Evidence: The file contains Python-style # comments and a variable assignment (DEFAULT_PHI_TAGS = [...]) rather than standard JSON structure, which could cause issues for tools expecting parseable JSON metadata.

dicom-anonymizer