The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill exposes a broad attack surface for indirect prompt injection due to the sensitivity of the settings it manages.
Ingestion points: The agent processes structured JSON configuration data from multiple GET endpoints, such as GET /api/settings/payload-rules and GET /api/settings/system-prompt, which could contain malicious instructions if the underlying data sources are compromised.
Capability inventory: The skill grants the agent high-privilege capabilities, including the ability to update the global system prompt (PUT /api/settings/system-prompt), disable mandatory login requirements (POST /api/settings/require-login), modify IP blacklists/whitelists (PUT /api/settings/ip-filter), and purge request and usage history logs.
Boundary markers: There are no explicit instructions or delimiters provided to the agent to treat the retrieved configuration data as untrusted or to ignore embedded instructions within that data.
Sanitization: The documentation does not specify any sanitization or validation logic for the values the agent provides when updating global system configurations.
[COMMAND_EXECUTION]: The skill instructions direct the agent to interact with a local service (https://localhost:20128) using curl commands to manage application state and configuration.
[DATA_EXFILTRATION]: The skill allows the agent to read comprehensive system metadata, including database statistics, proxy configurations, and internal memory settings, which represents a data exposure risk if the agent's context is exfiltrated to an unauthorized party.

omni-settings