The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill possesses an attack surface for indirect prompt injection because it processes untrusted data from an external FortiManager instance and ServiceNow environment.
Ingestion points: External data is introduced into the agent's context through tools such as fmg_get_policy_package, fmg_resolve_object, fmg_search_rules, and fmg_check_change_record as described in SKILL.md.
Boundary markers: There are no instructions or delimiters provided to the agent to differentiate between its system instructions and potentially malicious content embedded in firewall rule names, comments, or object definitions.
Capability inventory: The skill includes high-privilege tools such as fmg_install_package which can modify production firewall configurations, as well as recursive resolution and network communication via the MCP server.
Sanitization: The skill lacks instructions for the agent to sanitize or validate retrieved configuration data before using it in decision-making or subsequent command execution.
[COMMAND_EXECUTION]: The skill relies on an external Model Context Protocol (MCP) server defined by the environment variable $FORTINET_MCP_CMD. While this is a common integration pattern for agent platforms, it involves the execution of a runtime-defined command which could be pointed to arbitrary executables depending on the host environment configuration.

fortimanager-ops