The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill exhibits an attack surface for indirect prompt injection because it processes untrusted data extracted from external documents (PDFs and images) to perform file system operations.
Ingestion points: The agent is instructed to scan a user's directory and extract text from invoices and receipts (SKILL.md, Steps 1 and 2).
Boundary markers: No explicit delimiters or instructions to isolate the extracted content from the agent's core instructions are defined.
Capability inventory: The skill utilizes shell commands (mkdir, cp, mv) to modify the local file system and generates a CSV summary file (SKILL.md, Steps 5 and 6).
Sanitization: The instructions recommend removing special characters (except hyphens) from extracted vendor names and descriptions before using them in filenames, providing a basic level of protection against malicious path or command construction.
[COMMAND_EXECUTION]: The skill uses local shell commands (find, mkdir, cp, mv) to perform file management tasks. These operations are limited to the user's local directory, are transparently presented in the organization plan, and require user confirmation before execution.

invoice-organizer