The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is designed to process and review data derived from the analysis of external binary files, which constitutes a surface for indirect prompt injection.
Ingestion points: The skill reads data from various YAML artifacts, including functions.yaml, imports.yaml, strings.yaml, and callgraph.yaml located in artifacts/<target-id>/baseline/.
Boundary markers: There are no explicit delimiters or boundary instructions provided in the skill text to differentiate between instructional content and the data parsed from the Ghidra artifacts.
Capability inventory: The skill uses the ghidra-agent-cli to query analysis data and record findings. It possesses capabilities to write to the identified.yaml artifact and classify functions. Notably, the skill includes a constraint that prevents the agent from creating or running new Ghidra scripts without explicit user permission.
Sanitization: The instructions do not specify any validation or sanitization routines for the data ingested from the YAML artifacts before it is processed by the agent.

headless-ghidra-evidence