The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection because it ingests untrusted user data (the banner text) and interpolates it into a shell command.
Ingestion points: The argument-hint and instructions in SKILL.md indicate the agent takes a user-supplied string to generate a banner.
Capability inventory: The skill utilizes python -c to execute shell commands, providing a significant capability for exploitation.
Boundary markers: The instructions lack boundary markers or warnings to the agent to disregard instructions embedded within the user-supplied text.
Sanitization: There is no evidence of sanitization or escaping instructions for the TEXT placeholder in the command python -c "import pyfiglet; print(pyfiglet.figlet_format('TEXT'))".
[DYNAMIC_EXECUTION]: The skill uses dynamic execution to generate ASCII art at runtime.
Evidence: The instruction to use python -c "import pyfiglet; print(pyfiglet.figlet_format('TEXT'))" involves generating and executing a Python string on the fly.
[COMMAND_EXECUTION]: The skill explicitly instructs the agent to execute shell commands using python -c and the figlet CLI tool to perform its primary function.

ascii-banner