The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill ingests external data from SonarCloud APIs which serves as a potential indirect prompt injection surface. \n- Ingestion points: External data enters the agent context via SonarCloud API responses in scripts/sonarcloud_api.py. \n- Boundary markers: The skill formats output as Markdown/JSON but does not apply specific delimiters or instructions to ignore embedded commands within the fetched content fields. \n- Capability inventory: The skill is restricted to read-only GET requests to sonarcloud.io and sonarqube.us. The impact of injection depends on other capabilities granted to the agent. \n- Sanitization: The skill redacts credentials from URLs and errors via safe_source_url in scripts/inspect_sonarcloud_link.py but does not sanitize the natural language fields for prompt injection patterns.

sonarcloud-link-inspector