The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill exhibits an attack surface for indirect prompt injection because it ingests and acts upon existing workflow data.
Ingestion points: The skill retrieves the current state of a workflow using the get_current_workflow tool from the cc-workflow-studio MCP server as specified in SKILL.md.
Boundary markers: The instructions do not include boundary markers or explicit warnings to the agent to ignore or isolate natural language instructions that might be embedded within the ingested workflow JSON fields (e.g., in node names or data labels).
Capability inventory: The skill possesses the capability to modify the workflow canvas and execute changes through the apply_workflow and update_nodes tools.
Sanitization: There is no evidence of sanitization, schema validation, or content filtering mentioned in the instructions to handle potentially malicious content within the ingested workflow data.

cc-workflow-ai-editor