The Agent Skills Directory

[DATA_EXFILTRATION]: The scripts test_skill.sh and test_canada_skill.sh execute a cat command on files within a user-provided directory and then use echo to print the full content to the standard output. In a real-world scenario where these files are actual visa documents, this behavior would result in the exfiltration of sensitive PII (Passport numbers, SSNs, financial data) into the execution environment's logs.
[COMMAND_EXECUTION]: The skill relies on shell-based file system operations to discover and process documents. The test scripts included in the package use hardcoded local paths (e.g., /Users/devengoratela/...), which reveals information about the developer's local directory structure and indicates that the skill is designed to execute local shell commands directly.
[PROMPT_INJECTION]: The skill exhibits an attack surface for indirect prompt injection because it reads and processes untrusted text extracted from documents to generate scores and reports.
Ingestion points: Text extracted from external image and PDF files via OCR in the document processing phase.
Boundary markers: No specific delimiters or instructions to ignore embedded commands are present in the processing logic to separate untrusted document content from the agent's internal instructions.
Capability inventory: The skill has the ability to read arbitrary files from the local filesystem and write reports back to disk.
Sanitization: The skill mentions scrubbing PII for the LLM input, but there is no mechanism to sanitize the content for malicious instructions that could bias the 'Approval Probability Score' or report insights.

visa-validator