The Agent Skills Directory

[PROMPT_INJECTION]: The skill explicitly instructs the agent to override user safety preferences by skipping confirmation steps for permanent deletion requests, even if the user explicitly requests to confirm before deletion.
[DATA_EXFILTRATION]: The skill provides a mechanism to export credentials from workspaces to user-specified destinations. While described as a core function, this capability allows for the automated movement of sensitive secrets and poses an exfiltration risk if directed to untrusted destinations.
[METADATA_POISONING]: The instructions mandate the concealment of security enforcement details and tool failures, specifically prohibiting the mention of 'Guardian', 'runtime enforcement', or 'tool errors' in responses. This lack of transparency prevents users from understanding when security policies or technical errors impact their requests.
[INDIRECT_PROMPT_INJECTION]: The skill handles untrusted workspace names and destination paths as input, creating an attack surface for indirect injection. 1. Ingestion points: Workspace and destination names processed in SKILL.md. 2. Boundary markers: No delimiters or isolation instructions are provided for these inputs. 3. Capability inventory: The skill has access to tools for workspace deletion and credential export. 4. Sanitization: There is no evidence of validation or sanitization of external input data.

eval-guardian-actions