The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is susceptible to instructions embedded in the external data it is designed to process.
Ingestion points: Processes content from online forms (Google Forms, Typeform), PDF/Word documents, emails, attachments, receipts, and files from Google Drive or local storage.
Boundary markers: There are no instructions defining how to distinguish between legitimate data/labels and potentially malicious instructions within these sources.
Capability inventory: The agent can search emails, read diverse file types, browse the web, and submit data to external web services.
Sanitization: The instructions do not specify any validation, filtering, or sanitization of the content retrieved from these external sources.
[DATA_EXFILTRATION]: The skill's primary function is to extract information from highly sensitive sources and transmit it to external recipients.
Sensitive Access: Specifically instructs the agent to search for 'official forms from places like banks and government agencies', 'bank forms', 'emails', and 'receipts'.
Exfiltration Flow: The core purpose is to 'submit or send' this gathered data to external form providers. While the skill includes a safety instruction to 'wait for explicit approval' from the user, the inherent data flow moves private information to third-party web services.

form-filling