The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process untrusted user messages to trigger automatic responses, creating a surface for indirect injection attacks.
Ingestion points: The skill processes incoming chat messages via the auto-reply service and specifically through the /autoreply test command in index.ts.
Boundary markers: The system does not utilize explicit delimiters or 'ignore' instructions when interpolating user data or evaluating triggers, which could allow malicious messages to manipulate agent behavior.
Capability inventory: The skill has the ability to write configurations to the local file system (~/.clodds/auto-reply-rules.json) and perform pattern matching operations.
Sanitization: While the test command slices input messages to 10,000 characters, there is no validation or sanitization of the content to prevent prompt injection payload execution.
[DYNAMIC_EXECUTION]: The skill allows users to define and execute Regular Expressions via the /autoreply add-regex command.
Evidence: In index.ts, the skill uses new RegExp(pat, flags).test(...) to evaluate user-supplied patterns against message content.
Risk: Although the implementation limits the pattern length to 200 characters, it remains vulnerable to Regular Expression Denial of Service (ReDoS) attacks where a crafted regex could cause significant resource consumption during the matching process.

auto-reply