The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill establishes an attack surface where the agent ingests and processes untrusted data from external sources, which could lead to indirect prompt injection if those sources contain malicious instructions.
Ingestion points: Untrusted data enters the agent context through the analysis of remote server HTTP responses, error messages, rendered template outputs, and the content of generated emails (referenced in SKILL.md).
Boundary markers: The instructions lack specific delimiters or warnings to prevent the agent from obeying instructions embedded within the reflected data it is tasked with analyzing.
Capability inventory: The agent is directed to use network operations and conditional logic to execute further payloads based on the contents of ingested data.
Sanitization: There are no instructions for sanitizing, escaping, or validating the external content before it is processed by the agent's logic.
[COMMAND_EXECUTION]: The skill contains numerous explicit payloads for executing operating system commands (e.g., os.popen('id'), exec("id"), and backticks) across multiple platforms including Python (Jinja2), PHP (Twig), Ruby (ERB), and Java (Freemarker). While these are intended for use against external targets, they represent high-impact actions orchestrated by the skill instructions.

hunt-ssti