The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill creates an attack surface for indirect prompt injection by processing untrusted data from multiple external and local sources.
Ingestion points: In the audit mode (modes/audit.md), the skill uses the WebFetch tool to ingest the text content of arbitrary external pricing pages. Additionally, the diagnose (modes/diagnose.md) and waterfall (modes/waterfall.md) modes process user-supplied CSV files containing survey data and transaction records.
Boundary markers: The instructions do not specify the use of clear delimiters or instructions to ignore embedded commands within the fetched or read data, increasing the risk that an LLM might follow malicious instructions found in the source material.
Capability inventory: The skill is configured with tools to write files to the ./gtm/ directory and execute local scripts via the Bash tool. A successful injection could potentially leverage these capabilities to manipulate project files or execute unintended commands through tool interactions.
Sanitization: No explicit sanitization or validation of the ingested text is performed before it is added to the agent's context for analysis.
[COMMAND_EXECUTION]: The skill uses the Bash tool to execute local Python scripts for pricing validation and data analysis.
Evidence: The SKILL.md and various mode files authorize the execution of scripts located in the plugin root (e.g., score_price.py, decoy_validator.py). While these scripts are part of the pre-installed environment, the practice of passing user-controlled file paths as arguments to these scripts requires robust handling to prevent potential path traversal or command injection vulnerabilities if the agent's logic is manipulated.

pricing