The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill ingests data from external sources such as accounting software (1C, Moysklad), payment providers (YuKassa, Tinkoff), and user-provided CSV files. The instructions lack boundary markers or sanitization rules to prevent the agent from obeying malicious instructions that might be embedded within these external data sources (e.g., in transaction descriptions or invoice metadata).
Ingestion points: Data is pulled from ~~бухгалтерия, ~~платежи, and external CSV files.
Boundary markers: None present in the instructions.
Capability inventory: Access to Read, WebFetch, and Bash tools.
Sanitization: No mention of escaping or filtering external content before processing.
[COMMAND_EXECUTION]: The skill is configured with access to the Bash tool and instructions to execute workflows involving various financial connectors. In an adversarial scenario where malicious content is ingested via indirect prompt injection, the agent could be induced to execute unauthorized shell commands via this tool.
[EXTERNAL_DOWNLOADS]: The skill uses the WebFetch tool to retrieve data from external financial APIs and services. While the instructions focus on legitimate business integrations, there is no explicit validation or restriction within the skill's instructions to ensure the agent only communicates with intended, authenticated endpoints beyond platform-level tool restrictions.

plan-payroll