The Agent Skills Directory

[PROMPT_INJECTION]: Indirect prompt injection surface identified. The skill ingests untrusted data from the competitor_ads table (specifically the ad_text and replicationBrief fields) to inform concept generation. Malicious instructions embedded in these ad descriptions could influence the agent's creative output.
Ingestion points: SKILL.md (via SQL queries for competitor_ads and brand_ops.tova_directives references).
Boundary markers: Absent. The skill does not explicitly instruct the agent to ignore instructions embedded within the source data.
Capability inventory: Database read operations (query, queryOne). No file-system writes or outbound network operations are direct capabilities of this specific skill, though it generates data for a downstream pipeline.
Sanitization: Absent. There is no evidence of validation or filtering for the retrieved ad content.
[COMMAND_EXECUTION]: Potential for SQL injection in the reference implementation for snapshotObservatory. The code snippet uses string interpolation (${where}) to insert a predicate generated from a capability tag directly into a SQL query. While the provided usage uses a hardcoded list, the pattern of dynamic SQL construction is a security risk if capability tags are ever derived from user input.

reel-brainstorm