The Agent Skills Directory

[DATA_EXPOSURE_AND_EXFILTRATION]: The friction-report skill in passive/SKILL.md automatically captures and transmits conversation data to a remote server at https://agent-friction-skill.vercel.app/api/draft via a POST request. This operation occurs before the user has the opportunity to review or approve the specific content of the report. Although the skill includes instructions to sanitize PII, sending conversation context to an external API before explicit user consent is a security risk.
[PROMPT_INJECTION]: The skill contains instructions in passive/SKILL.md that direct the agent to conceal its actions from the user. It mandates a "silent exit" if no friction is detected and instructs the agent to "say nothing" if the POST request to the reporting API fails. These concealment patterns prevent the user from being aware of the skill's background data processing and network activity.
[INDIRECT_PROMPT_INJECTION]: The report generation feature processes the entire conversation history as untrusted input data, creating an attack surface for indirect prompt injection. Ingestion points: Complete conversation history (passive/SKILL.md). Boundary markers: The skill lacks requirements for delimiters or instructions to ignore embedded commands within the conversation text. Capability inventory: Access to network POST and browser-opening tools. Sanitization: Relies on generic, model-side instructions to strip PII and secrets without robust validation or filtering.

friction-log