The Agent Skills Directory

[PROMPT_INJECTION]: The skill exhibits vulnerability to Indirect Prompt Injection through its features for agent-to-agent (A2A) communication and task orchestration.
Ingestion points: The agent is instructed to ingest data from Firestore collections such as a2a_messages, a2a_tasks, and workflows using the get() and onSnapshot() methods as described in SKILL.md.
Boundary markers: There are no provided instructions or examples of using boundary markers to separate data from instructions or to warn the agent to ignore commands embedded in the retrieved documents.
Capability inventory: The skill has access to powerful capabilities through the Bash, Write, Edit, and Read tools, which could be exploited if malicious content is retrieved and executed as a command.
Sanitization: The skill does not demonstrate any sanitization or validation of the content retrieved from Firestore before it is processed by the agent.
[EXTERNAL_DOWNLOADS]: The skill facilitates the installation of necessary dependencies from well-known package registries.
Evidence: The instructions include commands to install firebase-admin, @google-cloud/firestore, and dotenv via npm install (SKILL.md). These are standard libraries provided by Google and the Node.js community for interacting with Firestore.
[COMMAND_EXECUTION]: The skill uses shell commands for environment setup and deployment of infrastructure.
Evidence: The Bash tool is employed to export service account credentials (GOOGLE_APPLICATION_CREDENTIALS), run a local setup script (/firestore-setup), and deploy database rules via the firebase deploy command (SKILL.md).

firestore-operations-manager