The Agent Skills Directory

[PROMPT_INJECTION]: The skill exhibits a vulnerability surface for indirect prompt injection because it is designed to ingest and act upon data from external, untrusted environments.
Ingestion points: The orchestrator relies on sub-agents like analyse-sentiment, analyse-narrative, and analyse-onchain to fetch data from potentially attacker-controlled sources such as news feeds, social media sentiment, and blockchain metadata.
Boundary markers: The skill lacks explicit instructions or technical delimiters to distinguish between retrieved data and system instructions, which could lead the model to follow malicious commands embedded in the data.
Capability inventory: The skill possesses the ability to generate financial recommendations via the coinbase-cdp-connector and modify internal persistent storage at crypto/GOAL.md.
Sanitization: There is no evidence of sanitization, filtering, or validation of the external content before it is synthesized into the final answer.
[COMMAND_EXECUTION]: The desk utilizes a strategy-discovery-backtest gate. While the implementation details of this sub-skill are not provided, backtesting components frequently involve dynamic code execution or complex processing that could be exploited if the input strategy or parameters are manipulated through indirect injection.

crypto-desk