The Agent Skills Directory

[PROMPT_INJECTION]: The skill creates a surface for Indirect Prompt Injection by rendering untrusted external data directly into the agent's context and generated outputs without sufficient sanitization.
Ingestion points: Untrusted data enters the agent context through several template variables defined in the template.html.j2 files of various archetypes, including body_html, lede, paragraphs, and html_content (e.g., in folio/template.html.j2 and field/template.html.j2).
Boundary markers: The templates do not utilize delimiters or specific instructions to the agent to disregard potential commands hidden within the provided data.
Capability inventory: The skill uses the |safe filter in multiple templates, disabling default HTML escaping (e.g., {{ s.html_content | safe }} in folio/template.html.j2). Additionally, the Javascript logic in catalog/template.html.j2 utilizes innerHTML to inject content from JSON payloads (e.g., s.innerHTML = payload.body_html;), allowing for arbitrary script execution in the generated report.
Sanitization: No escaping, validation, or filtering of the external content is performed before it is rendered into the final HTML output.

html-reports