The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection as it processes data from untrusted external sources.
Ingestion points: The agent ingests external content through web_search results and content extracted from images via understand_image (defined in SKILL.md).
Boundary markers: The skill lacks explicit instructions or delimiters to tell the agent to ignore or isolate instructions that might be embedded within search results or image content.
Capability inventory: The skill allows for web searching and reading of local/remote files. The workflow section in SKILL.md also suggests integration with other tools like browser automation (@pw), which could increase the impact of a successful injection.
Sanitization: There is no mention of sanitizing, filtering, or validating the text or data extracted from external search results or images before the agent processes it.
[DATA_EXFILTRATION]: The understand_image tool in SKILL.md allows the agent to access local file paths through the image_source parameter. While intended for legitimate image analysis, this capability could be misused to read sensitive local files if the agent is manipulated via prompt injection.

minimax