The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted text provided by the user for auditing purposes. This inherently creates a surface for indirect prompt injection if the audited text contains malicious instructions. The skill includes specific defensive measures to mitigate this risk.
Ingestion points: Audited text is ingested via direct paste into the prompt or by reading local files specified by the user.
Boundary markers: The instructions in SKILL.md explicitly mandate wrapping input text in <input_text> tags and direct the agent to treat all content within those tags as data specimens, never as instructions.
Capability inventory: The skill has access to Read, Glob, and Bash tools. The primary detection logic is performed by a local Python script.
Sanitization: The score.py script performs regex and statistical analysis; it does not execute the ingested text.
[COMMAND_EXECUTION]: The skill utilizes the Bash tool to run a local Python script (scripts/score.py) for deterministic scoring of text. The allowed-tools configuration correctly limits the tool to python3 * commands, and the executed script is a reviewed part of the skill package.
[DYNAMIC_CONTEXT_INJECTION]: The SKILL.md file contains a dynamic context injection pattern (!python3 --version) used to verify the environment at load time. This command is benign and serves a legitimate diagnostic purpose.

slop-detector