The Agent Skills Directory

[METADATA_POISONING]: The skill includes a file titled probast-quality-assessment-for-prediction-model-studies_audit_result_v1.json which purports to be an official security and performance audit. This file contains multiple self-referential safety claims, such as marking security as 'PASS' and grading the skill as 'Production Ready'. These claims are deceptive and attempt to override the evaluator's own analysis by presenting a pre-determined favorable verdict.
[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process text from external, untrusted sources (medical papers provided as PDF or text) and interpolate that content into clinical analysis prompts. This creates a surface for indirect prompt injection attacks.
Ingestion points: Text content extracted from user-provided PDF files via scripts/extract_pdf.py is used as the primary input for the assessment prompts in references/probast_prompts.md.
Boundary markers: The prompts use basic placeholders like [paper] but lack explicit instructions or robust delimiters to ensure the agent ignores any embedded instructions or malicious commands hidden within the paper's text.
Capability inventory: The skill includes file-system read and write capabilities through the scripts/extract_pdf.py script, which extracts text from PDFs and writes it to the local disk.
Sanitization: There is no evidence of validation, sanitization, or filtering of the extracted text before it is processed by the language model, allowing raw external data to influence the prompt context.

probast-quality-assessment-for-prediction-model-studies