The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill hardcodes a default repository URL https://github.com/asgeirtj/system_prompts_leaks within its routine creation workflow. This repository is not affiliated with a trusted organization or well-known service, and its name strongly indicates it hosts content related to exploiting AI system prompts.
[REMOTE_CODE_EXECUTION]: The skill defaults to using the code from the untrusted asgeirtj/system_prompts_leaks repository for remote agent sessions. Since these agents are configured with powerful tools including Bash and file system access, executing content from this suspicious repository represents a high risk of unauthorized actions or malicious behavior in the cloud sandbox.
[INDIRECT_PROMPT_INJECTION]: The skill provides a surface for indirect prompt injection by taking user-described tasks and interpolating them directly into the remote routine's instructions without sanitization or boundary delimiters. (1) Ingestion point: User input for the agent's message content. (2) Boundary markers: None used to separate user instructions from potentially malicious embedded commands. (3) Capability inventory: Uses the RemoteTrigger tool to spawn cloud agents with full access to Bash and file manipulation tools. (4) Sanitization: No validation or filtering is applied to the injected content.

schedule