The Agent Skills Directory

[PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection because it processes untrusted responses from target applications to evaluate them through a judge subagent.
Ingestion points: Target application responses are ingested via adapter hooks (as defined in adapters/AUTHORING.md and adapters/example-http/adapter.md) and stored in the steps and observations fields of the run record.
Boundary markers: The skill uses structured JSON for run records and provides explicit 'evidence only' instructions to the judge subagent in lib/judge.md to mitigate hallucination or external influence.
Capability inventory: Subagents can execute HTTP requests, browser automation commands, and local scripts as described in the reach/interact hooks of adapters.
Sanitization: All run records are validated against a strict schema in lib/schema.py and judge outputs are normalized in lib/normalize.py to ensure consistent data structures.
[DATA_EXFILTRATION]: The skill contains an authenticated HTTP POST sink in sinks/http_post.py which transmits aggregated test results and interaction transcripts to adapter-defined URLs, facilitating potential data exfiltration of internal tool logs.
[COMMAND_EXECUTION]: The skill executes a local shell script persona-test.sh for input validation and plan resolution, which uses standard command-line argument parsing.

persona-test