The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill acts as an ingestion point for untrusted external data, which can be exploited for indirect prompt injection attacks.
Ingestion points: The JSONParser, CSVParser, and XMLParser classes in SKILL.md are designed to read and parse data from external files into the agent's context.
Boundary markers: There are no explicit instructions or delimiters to help the agent distinguish between the skill's operational instructions and potentially malicious instructions embedded within the processed data files.
Capability inventory: The skill possesses capabilities for file writing (aiofiles.open, open), file deletion (os.remove, Path.unlink), and directory manipulation, which could be abused if an injected instruction is followed.
Sanitization: Although the skill validates file paths and sizes, it does not sanitize the content of the files. Notably, the XMLParser uses the standard xml.etree.ElementTree library, which is vulnerable to XML External Entity (XXE) and Billion Laughs attacks, potentially allowing for local file disclosure or denial-of-service.

file-handling