The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill exposes an attack surface for indirect prompt injection due to its handling of untrusted input strings.
Ingestion points: The keyName field in createApiKey and the name field in createPrincipal (documented in SKILL.md and references/api-keys.md) accept arbitrary strings.
Boundary markers: There is no documentation regarding the use of delimiters or specific instructions to the agent to ignore potentially malicious content within these name fields.
Capability inventory: The skill provides access to sensitive identity management operations, including createApiKey, createOrgApiKey, and createOrgPrincipal.
Sanitization: The skill instructions do not specify any validation or sanitization requirements for these input fields.
[CREDENTIALS_UNSAFE]: The reference material in references/api-keys.md provides code examples that output sensitive plaintext API keys to the console using console.log. This could lead to accidental credential exposure in development logs or terminal sessions if developers follow the example literally.
[PRIVILEGE_ESCALATION]: The bypassStepUp attribute within the principal identity model (described in SKILL.md and references/principal-model.md) allows for the bypass of Multi-Factor Authentication (MFA). While identified as a requirement for non-interactive agents, this flag represents a mechanism that could be misused to reduce the security posture of an account by removing interactive verification steps.

constructive-principals