The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from external sources and project workbooks, which can influence the agent's logic during an audit.
Ingestion points: The skill retrieves live product facts from the web via WebFetch (SKILL.md Step 2) and reads data from user-supplied workbooks (.xlsx, .xlsm) and CSV files (SKILL.md section 'Input and authority').
Boundary markers: The instructions do not define specific delimiters or 'ignore' instructions to wrap untrusted content retrieved from external sources.
Capability inventory: The agent has access to Write for saving reports, Bash for shell operations, and WebFetch for network access (SKILL.md and host-contract.json).
Sanitization: While Step 4 mentions ASCII-escaping for input hashes, there is no comprehensive sanitization of the content from external sources before it is processed by the agent.
[DATA_EXFILTRATION]: The skill's configuration (host-contract.json) lists numerous sensitive project files, including INVOICES.csv, TIME.csv, and agreement/, as non-owned records. These files may be accessible to the agent via Read, Grep, or Glob tools during the audit process, creating a data exposure risk.
[COMMAND_EXECUTION]: The skill is granted access to the Bash tool and performs complex file operations like workbook_preservation.compare, which involves inspecting the internal ZIP/XML structure of Excel workbooks (SKILL.md).

product-audit