The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill parses XML data from external construction systems, creating a surface for indirect prompt injection. Malicious instructions could be embedded within XML text nodes or attributes to influence the agent's logic.
Ingestion points: ConstructionXMLReader.parse_file and ConstructionXMLReader.parse_string in SKILL.md.
Boundary markers: Absent in the code; instructions mention generic input validation but no technical delimiters are enforced.
Capability inventory: The skill has filesystem permissions (declared in claw.json) and processes data into DataFrames for agent consumption.
Sanitization: No content filtering or sanitization of XML text is performed.
[DATA_EXPOSURE]: The parse_file method in SKILL.md uses ET.parse(file_path) which allows the agent to read arbitrary file paths. If an attacker influences the path provided to this method, it could lead to unauthorized reading of local system files.
[UNVERIFIABLE_DEPENDENCIES]: The skill utilizes the standard xml.etree.ElementTree library. This module is known to be vulnerable to XML entity expansion attacks, such as Billion Laughs, which can be leveraged to cause denial-of-service when parsing untrusted construction data.

xml-reader