The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted user-provided files (such as text, Markdown, and HTML) and interpolates their content into prompts generated for Layer B rewriting in scripts/rewrite_text.py. These prompts are intended to be processed by an LLM, which creates a potential surface for indirect prompt injection if an attacker embeds malicious instructions within the input data. The skill implements basic mitigation by using a delimiter to separate instructions from user content.
Ingestion points: User files are read in scripts/clean_file.py and scripts/inspect_file.py using helpers in scripts/common.py.
Boundary markers: The generated prompts in scripts/rewrite_text.py use --- as a delimiter to separate instructions from the user-provided text.
Capability inventory: The skill has local file read/write access and executes local Python scripts.
Sanitization: The skill's primary purpose is to sanitize Unicode and metadata, which reduces the surface for hidden instructions, though it does not explicitly filter for LLM-targeted injection patterns.
[SAFE]: The skill incorporates multiple security hardening measures that demonstrate a proactive safety posture.
Resource Limits: Implements a 256 MiB whole-file cap and a 64 MiB stdin cap in scripts/common.py to prevent memory exhaustion and Denial-of-Service attacks.
Zip Bomb Protection: The _check_zip_budget function in scripts/container_meta.py validates the decompressed size of Office document components against a 128 MiB limit before extraction.
Secure File Handling: The safe_write_bytes function in scripts/common.py performs atomic file writes using temporary files and includes an explicit check to refuse writing through symlinks, mitigating common file-system-based attacks.
Local Execution and Dependency Management: The skill is implemented in pure Python using only standard library modules, avoiding risks associated with external package registries or remote code execution. It contains no network operations or external binary calls.

remove-ai-marks