The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection because it processes untrusted ELF binary files and extracts data that is then interpreted by the agent.
Ingestion points: The scripts scripts/elf_report.py, scripts/memory_map.py, and scripts/top_symbols.py all take a file path to a firmware binary as input and parse its contents.
Boundary markers: The generated reports lack clear delimiters or instructions to the agent to ignore instructions embedded within the binary data. Notable strings extracted from the binary are presented as a simple list.
Capability inventory: The skill has the ability to execute shell commands via subprocess.run and write files to the local disk.
Sanitization: No sanitization is performed on the symbol names or strings extracted from the ELF files. Attackers could embed malicious prompt commands in the string tables of binaries to be analyzed.
[DYNAMIC_EXECUTION]: The Python scripts use the subprocess module to execute toolchain binaries at runtime.
Evidence: scripts/elf_report.py, scripts/memory_map.py, and scripts/top_symbols.py all use subprocess.run to call arm-none-eabi-* tools. While the arguments are passed as a list (avoiding shell injection), it represents runtime execution of external processes based on user-provided file paths.

firmware-analyze