The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill enables an attack surface for indirect prompt injection by design, as it processes content from an external service that may contain attacker-controlled text.
Ingestion points: In SKILL.md, the agent is instructed to fetch bookmarks and highlights using GET /raindrops/{collectionId} and GET /raindrop/{id}. The fields retrieved—specifically title, excerpt, note, and highlights—are often derived from external web content that could contain malicious instructions.
Boundary markers: The instructions do not specify any boundary markers or special delimiters to separate the retrieved data from the agent's core instructions, increasing the likelihood of the agent obeying instructions embedded within a bookmark's note or title.
Capability inventory: The skill utilizes powerful CLI tools (curl, jq) and provides templates for network requests and file operations, including a file upload endpoint (PUT /raindrop/file in SKILL.md), which could be abused if an injected instruction targets local sensitive files.
Sanitization: There are no requirements or examples for sanitizing, escaping, or validating the text content returned by the Raindrop.io API before the agent incorporates it into its context or decision-making process.

raindrop-api