The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process data from external, untrusted sources, creating a potential surface for indirect prompt injection.
Ingestion points: In modes/indexability.md, the skill uses curl to fetch HTML and headers from user-provided URLs. In modes/citation-record.md and modes/review.md, the skill processes answers and citations generated by AI engines like ChatGPT and Perplexity.
Boundary markers: The instructions lack specific boundary markers or instructions to the agent to disregard potential control sequences or malicious prompts embedded within the fetched HTML content or AI responses.
Capability inventory: The skill is authorized to write to the ./gtm/** directory and execute a local Python script (score.py) using the Bash tool. These capabilities could be leveraged if the agent is successfully manipulated by external content.
Sanitization: The skill does not implement sanitization or validation of the fetched external data before it is presented to the agent or passed to the scoring utility.

geo