The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes product data (names, descriptions, tags) which are external ingestion points that could contain malicious instructions. While the skill is designed to be read-only, it lacks explicit boundary markers or sanitization logic to differentiate between data and instructions during the audit process.
Ingestion points: Product details retrieved via shop_list_products and shop_get_product (specifically the description field).
Boundary markers: None identified in the prompt instructions for isolating product content.
Capability inventory: No dangerous operations (subprocess calls, file system writes, or network exfiltration) were found in the provided workflow.
Sanitization: No content escaping or validation logic is specified for the ingested product strings.

shop-catalog-audit