The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes third-party integration artifacts (integration vocabulary maps and search outputs) and reference files from a 'producer package'. These external inputs represent a surface for indirect prompt injection, particularly within 'description', 'notes', and 'evidence_quote' fields.
Ingestion points: search-output.valid.yaml, integration-vocabulary-map.valid.yaml, and various producer-package paths such as source-registry.yaml and category-vocabulary.md.
Boundary markers: The skill relies on structured YAML parsing but lacks explicit 'ignore embedded instructions' warnings for the processing of free-text fields in external artifacts.
Capability inventory: The skill requires the agent to perform network requests (resolution and fetching) and suggests the use of CLI tools like yq and gh (documented as evidence).
Sanitization: While the search-output.valid.yaml fixture mentions that 'text was neutralised', there is no explicit sanitization requirement for the agent's own ingestion pipeline.
[COMMAND_EXECUTION]: The search output fixtures (e.g., in references/fixtures/search-output.valid.yaml) contain specific shell commands using tools like yq, gh api, and curl as a record of historical queries. A downstream agent misinterpreting these 'queries' as current instructions rather than historical data could lead to unauthorized local tool execution.
[DATA_EXFILTRATION]: Conditions C7 (Authority record) and C8 (Vendor-host item_id) in references/conditions.md explicitly require the agent to make external network requests to verify 'locator' URLs and resolve vendor domain ownership. An attacker could potentially use these verification steps to trigger requests to malicious domains if they can control the URLs provided in the artifact under review.

reviewing-integrations-prior-art-survey