The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill ingests potentially untrusted data from Cisco ISE (e.g., endpoint metadata, identity group names, or policy descriptions) and includes it in audit reports or passes it to downstream tools like visualization and record-keeping scripts.
Ingestion points: Data is retrieved from ISE via tools such as endpoints, network_access_policy_set, identity_groups, and active_sessions in SKILL.md.
Boundary markers: No specific boundary markers or instructions to ignore embedded instructions are present when processing this data.
Capability inventory: The skill can execute various subprocesses via $MCP_CALL including scripts for GAIT recording and Markmap visualization.
Sanitization: There is no evidence of sanitization or escaping of the external data before it is interpolated into final reports or passed to other tools.
[DYNAMIC_EXECUTION]: The skill utilizes environment variables (ISE_MCP_SCRIPT, GAIT_MCP_SCRIPT, MARKMAP_MCP_SCRIPT) to resolve paths for script execution at runtime. While this is a common pattern for local automation, it allows the agent to execute code from paths that are not statically defined within the skill itself.
[COMMAND_EXECUTION]: The audit procedure involves direct shell command execution that incorporates user credentials (ISE_USERNAME, ISE_PASSWORD) as environment variables. While standard for many automation tasks, this pattern can lead to credential exposure in process trees or shell history.

ise-posture-audit