The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes data from external, potentially attacker-controlled sources such as accounting software (1C/MoySklad), payment systems (Yookassa/Tinkoff), and uploaded CSV files. This creates a surface where malicious instructions could be embedded in financial records to influence the agent's behavior.
Ingestion points: Accesses data via ~~бухгалтерия and ~~платежи connectors and processes user-provided CSV fallbacks (SKILL.md, Step 1).
Boundary markers: No explicit delimiters or instructions to ignore embedded commands are specified for the data ingestion phase, although human-in-the-loop "approval gates" are required for subsequent actions.
Capability inventory: The skill has access to the Bash tool for script execution and reporting, and can send communications via ~~почта and ~~мессенджер (SKILL.md, Step 2).
Sanitization: No explicit sanitization or validation of the ingested financial data is described prior to processing or inclusion in prompts.
[COMMAND_EXECUTION]: The skill uses the Bash tool to perform data analysis and generate report files such as XLSX documents for the user to download. This is a powerful capability that, while used for functional purposes here, increases the impact if the skill's logic is subverted.

plan-payroll