The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted user-provided technical documentation, configuration files, and oral scripts to extract URLs, package identifiers, and CLI commands for automated verification against external sources.
Ingestion points: Reads all relevant files in the workspace, including .md, .py, .sh, .json, .yaml, and .env files (specifically targeted for variable extraction).
Boundary markers: The instructions do not define specific delimiters or 'ignore' instructions to prevent the agent from following malicious commands or instructions embedded in the audited text.
Capability inventory: Employs network-capable tools including curl, gh (GitHub CLI), npm, pip, and web search to validate extracted strings.
Sanitization: There is no mention of sanitizing or escaping the extracted content before passing it to network tools or the agent context, allowing for potential SSRF via audited URLs.
[DATA_EXFILTRATION]: The skill is configured to scan for and identify sensitive file paths and environment variable names during its audit phase, which involves reading the contents of these files.
Sensitive paths: Instructions specifically target patterns such as ~/.ssh/, ~/.aws/credentials, .env, and ~/.config/ to verify their usage in technical documentation or deployment scripts.
Sensitive identifiers: The regex \b[A-Z_]{3,}\b is used to extract environment variable names like OPENAI_API_KEY from configuration and script files to check for correct naming or presence.

laohan-shencha