The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted HTML content fetched from external Email Service Providers (ESPs) or provided directly via user input. This creates an attack surface for indirect prompt injection where malicious instructions could be embedded in the email body or metadata to influence the agent's behavior or QA report.
Ingestion points: Data fetched from ESPs via tools like get_campaign, tool_get_draft, and tool_get_sent, as well as direct user-pasted HTML/text.
Boundary markers: The instructions do not specify the use of clear delimiters or warnings to the agent to treat the email content strictly as data and ignore any embedded instructions.
Capability inventory: The skill possesses the Bash tool, WebFetch for network requests, and the ability to create findings via mcp__cogny__create_finding.
Sanitization: There is no evidence of sanitization or filtering applied to the external HTML content before it is processed by the agent.
[COMMAND_EXECUTION]: The skill is granted access to the Bash tool. While intended for benign tasks such as checking HTML size, the availability of a shell environment when processing untrusted external data increases the potential risk if the agent is manipulated via prompt injection.

pre-send-qa