The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and validate data from external sources, which creates a potential surface for malicious instructions to be embedded within data files.
Ingestion points: According to instructions.md, the agent is expected to accept project data from CSV, Excel, and JSON files or direct user input.
Boundary markers: The skill instructions do not define clear delimiters or specific warnings to prevent the agent from following instructions contained within the validated data.
Capability inventory: As specified in claw.json, the skill has access to filesystem and network permissions, enabling it to read local files and potentially communicate externally.
Sanitization: The SchemaValidator class in SKILL.md implements type, range, and regex-based format checks, but it does not sanitize data for LLM instruction patterns.
[DATA_EXFILTRATION]: The skill requests significant environment permissions that increase the impact of potential vulnerabilities.
Evidence: The claw.json manifest requests both filesystem and network permissions. While necessary for processing local data files and potentially fetching external schemas, these capabilities could be misused if the agent is successfully targeted by a prompt injection attack.

schema-validation