The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill extracts and processes text from user-provided DOCX files, creating an attack surface for indirect prompt injection where malicious instructions inside a document could influence the agent's behavior.
Ingestion points: Footnote text is extracted from the word/footnotes.xml component of user-supplied DOCX files in scripts/extract_footnotes.py and scripts/docx_footnotes.py.
Boundary markers: The extracted footnote content is interpolated directly into LLM prompts in scripts/gemini_audit.py without the use of clear delimiters or instructions to ignore embedded commands.
Capability inventory: The skill has the capability to write and overwrite files on the local filesystem (scripts/apply_corrections.py, scripts/create_crossrefs.py) and perform network operations to the Gemini API, Perma.cc API, and Vertex AI services.
Sanitization: No sanitization, escaping, or filtering of the extracted document text is performed before it is sent to the LLM for analysis.

bluebook-audit