The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection because it reads search queries and geographic target names from a Google Sheet and interpolates them directly into an LLM prompt.
Ingestion points: scripts/analyze.py fetches data from columns C (Query) and H (GEO Names) of a user-specified Google Sheet in the read_pending_queries function.
Boundary markers: The script lacks explicit boundary markers or delimiters for the ingested content, and the system prompt does not include instructions to ignore potentially malicious content within the search queries.
Capability inventory: The skill possesses credentials for the Google Sheets API (read/write access) and the OpenAI API, and it has the capability to write results back to the spreadsheet.
Sanitization: There is no evidence of input validation, escaping, or sanitization for the data retrieved from the spreadsheet before it is serialized to JSON and sent to the OpenAI API.
[EXTERNAL_DOWNLOADS]: The installation instructions in the README.md describe downloading the skill's components using curl from the author's public GitHub repository (fourteenwm/ppc-ai-skills). This is a documented part of the skill's deployment from the vendor's own infrastructure.

geo-conflict-analyzer