The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill retrieves and processes vulnerability information from multiple external sources, which could theoretically contain malicious instructions embedded within CVE descriptions or security advisories.- Ingestion points: Data is ingested from external APIs including the NVD (services.nvd.nist.gov), OSV.dev (api.osv.dev), and GitHub Advisory Database (api.github.com), as well as real-time search results via the Exa tool.- Boundary markers: The skill instructions do not specify any boundary markers or delimiters to isolate untrusted external content from the agent's internal instructions.- Capability inventory: The skill is limited to performing network requests to known vulnerability databases and web search tools. It does not include capabilities for file system modification, command execution, or environment variable access.- Sanitization: No sanitization or validation procedures are defined for the content retrieved from external vulnerability databases before it is integrated into the agent's context.

cve-research