The Agent Skills Directory

[PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection due to its handling of external itinerary data.
Ingestion points: The parse_matrix_link and parse_manual_itinerary tools in scripts/runtime/server-core.mjs ingest data from external itinerary URLs and user-provided flight search JSON or rules text.
Boundary markers: Absent. The traveler-safe-audit-brief prompt in scripts/runtime/server-core.mjs interpolates variable data (e.g., facts.discrepancyLines, facts.truthLines) directly into its instructional context without using delimiters or protective instructions like "ignore embedded commands."
Capability inventory: The agent is instructed to use browser automation for searching and possesses tool-execution capabilities.
Sanitization: While input structure is validated using Zod schemas, the textual content of fare rules and itinerary data is not sanitized for potential adversarial instructions before being passed to the model.
[DATA_EXFILTRATION]: The skill contains a configuration-based network risk.
Evidence: The createMatrixMateClient function in scripts/runtime/client.mjs determines the target API endpoint using the MATRIX_MATE_BASE_URL environment variable. While it defaults to the local loopback address (127.0.0.1), a misconfigured or malicious environment could redirect data intended for the local parser to a remote attacker-controlled domain.

matrix-mate-offline