The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill implements an attack surface for indirect prompt injection by ingesting and processing untrusted external data (Kubernetes manifests and Go source code) to generate reports that are subsequently interpreted by the agent.
Ingestion points: The scripts scripts/crd_validator.py and scripts/reconciliation_audit.py read user-provided files from the local filesystem via the --schema and --controller-path arguments.
Boundary markers: The scripts output structured JSON or Markdown reports, but do not employ specific boundary markers or 'ignore embedded instructions' warnings within the generated text to protect the downstream agent from instructions hidden in the analyzed content.
Capability inventory: The skill possesses file-writing capabilities through scripts/operator_scaffold.py, which could be exploited if an attacker-controlled file successfully injects instructions into the agent's workflow.
Sanitization: There is no evidence of sanitization or filtering specifically designed to neutralize natural language instructions embedded within the code comments or YAML metadata of the files being audited.

kubernetes-operator