The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill instructs the agent to dynamically discover tool schemas and execution strategies from the RUBE_SEARCH_TOOLS endpoint, which introduces a potential for malicious instructions to be ingested from the external service provider.
Ingestion points: Tool schemas, execution plans, and recommended pitfalls are fetched from rube.app at runtime and processed by the agent in SKILL.md.
Boundary markers: There are no instructions or delimiters provided to ensure the agent treats the fetched tool descriptions and recommended plans as untrusted data.
Capability inventory: The agent is granted the ability to execute sensitive Bitwarden operations (credentials management) based on the schemas and tool slugs discovered at runtime through the RUBE_MULTI_EXECUTE_TOOL capability.
Sanitization: The instructions do not define any validation or filtering mechanisms for the data returned from the MCP server before it is used to construct execution commands.

bitwarden-automation