The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process BPMN 2.0 XML files, which are untrusted external data sources. This creates a surface for indirect prompt injection if those files contain malicious instructions.
Ingestion points: The skill reads .bpmn files from the filesystem using grep and standard file-reading operations to locate elements for editing.
Boundary markers: The instructions do not specify the use of delimiters or boundary markers (such as XML comments or dedicated tags) to isolate process content from agent instructions during processing.
Capability inventory: The skill utilizes the c8ctl CLI for linting and formatting, and performs file system writes via Edit operations. These capabilities could be leveraged if an injection in a BPMN file successfully influences the agent's actions.
Sanitization: While the skill provides instructions for XML entity encoding (e.g., < for <), it lacks specific sanitization logic to prevent natural language instructions embedded in BPMN metadata or documentation fields from being interpreted as commands by the AI.
[EXTERNAL_DOWNLOADS]: The skill instructs the user to install an external package to provide necessary CLI functionality.
Evidence: Recommends running npm install -g @camunda8/cli in SKILL.md to ensure the bpmn format command is available. This is a legitimate vendor-owned resource provided by the author ('camunda').

camunda-bpmn