The Agent Skills Directory

[PROMPT_INJECTION]: The skill exhibits a vulnerability to indirect prompt injection by ingesting untrusted data from multiple sources without adequate safeguards. An attacker who can modify the fitness or health logs could embed instructions that the agent might execute.
Ingestion points: The skill reads data from data/fitness-logs/, data/fitness-tracker.json, data/hypertension-tracker.json, data/diabetes-tracker.json, and data/profile.json.
Boundary markers: Absent. There are no instructions provided to the agent to treat the contents of these files strictly as data or to ignore embedded commands.
Capability inventory: The skill is configured with Read, Grep, Glob, and Write tools, allowing it to both inspect the file system and modify files.
Sanitization: Absent. No validation, escaping, or filtering of the external content is defined before the data is processed by the agent.

fitness-analyzer