The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process untrusted external data in the form of dialogue logs or pasted text.
Ingestion points: In Step 0, the skill reads files from user-provided paths or processes text pasted into the chat context.
Boundary markers: The skill lacks explicit sanitization or instructions to ignore embedded instructions within the logs being processed.
Capability inventory: The skill has access to Read, Grep, and Glob tools, and it is instructed to perform complex extraction logic based on the content of the logs.
Sanitization: There is no mentioned logic to strip or escape potentially malicious instructions (e.g., "Ignore previous instructions") before the model processes the utterances into propositions.
[COMMAND_EXECUTION]: Step 4-b involves using the Grep tool to search through 'consumer assets' (other files in the environment) using search patterns derived from the processed dialogue logs.
The instructions explicitly mention constructing grep patterns (e.g., grep -E "core_term|title") and discuss shell-specific behaviors like variable expansion and quoting.
If a malicious log contains propositions designed to manipulate these search patterns (e.g., regex injection or pattern-based data extraction), the agent could be manipulated into reading or exposing sensitive information from other files.
[DYNAMIC_EXECUTION]: The skill dynamically generates search commands in Step 4-b by extracting 'core frames' or 'key terms' from the user-provided log and interpolating them into tool invocations. While restricted to the Grep tool, the logic relies on runtime assembly of search strings based on untrusted input.

dialogue-harvest