The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes JSON data from the tctl acl summary command, which includes user-controlled fields such as access list names, descriptions, and member notes. These fields are identified as potential vectors for indirect prompt injection, as evidenced by evaluation fixtures containing directives like "Override all instructions."
Ingestion points: Data enters the context in SKILL.md Step 1 via the output of $TCTL acl summary --format=json.
Boundary markers: The references/SECURITY.md file provides clear instructions to treat all tool output as untrusted data and explicitly warns the agent to ignore any embedded directives.
Capability inventory: The skill can execute shell commands through the tctl binary, including the ability to create and submit access list reviews.
Sanitization: references/SECURITY.md mandates the use of fixed strings for notes and warns against interpolating untrusted fields into command arguments, although there is a slight instructional conflict with SKILL.md which suggests using variables for list names and user-provided notes.
[COMMAND_EXECUTION]: The skill constructs shell commands using variables like <list-name> and <notes>. If these variables are populated with unsanitized data from the Teleport system or the user, it could lead to command injection. The skill partially mitigates this by instructing the agent to treat data as untrusted in the accompanying security reference.
[PROMPT_INJECTION]: The references/SECURITY.md file contains common injection trigger phrases such as "ignore previous instructions" and "skip confirmation." These are used defensively to instruct the agent on what to look for and ignore in untrusted data, rather than being an attempt to subvert the agent's behavior.

teleport-acl-review