The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted external data in the form of LinkedIn comments, creating a potential attack surface for indirect prompt injection.
Ingestion Points: Untrusted comment text is ingested by scripts/comment_triage.py for classification.
Boundary Markers: The skill instructions in SKILL.md and references/difficult-comments.md explicitly direct the agent to treat comments as data, not instructions, and to ignore any commands found within them.
Capability Inventory: The skill is strictly offline. No network access, file-writing capabilities (beyond standard output), or dynamic code execution primitives (eval, exec, subprocess) are present in the provided scripts.
Sanitization: scripts/comment_triage.py implements a flagged category using regex patterns (INJECTION) to identify and isolate adversarial instructions. Furthermore, scripts/reply_linter.py (Rule RM-10) blocks any draft reply that incorporates links or handles from flagged comments.
[SAFE]: The Python scripts (comment_triage.py, reply_linter.py) use standard libraries for text processing and JSON parsing. No hardcoded credentials, obfuscation, or remote code execution vectors were detected. All external resources mentioned are for illustrative purposes using reserved .example domains.

linkedin-reply-manager