The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The WorkflowEngine implementation in SKILL.md uses a data interpolation logic ({{nodeId.key}}) that injects results from previous nodes into the configuration of subsequent tools.
Ingestion points: Data enters the context from the results of executeLLM and executeMCP calls, which are stored in the engine's state map.
Boundary markers: No boundary markers or "ignore" instructions are present to prevent the agent from following instructions embedded in the interpolated data.
Capability inventory: The engine executes powerful capabilities via callMcpTool, including database queries, file operations, and browser automation as mentioned in the skill description.
Sanitization: The interpolate method performs a global regex replacement on a stringified JSON object without sanitizing the injected values, which could allow malicious content to break the JSON structure or manipulate tool arguments.
[DYNAMIC_EXECUTION]: The interpolate method in SKILL.md dynamically constructs a JSON string by replacing placeholders with data from previous node executions and then processes it using JSON.parse. While this is a standard template pattern, doing so without validation on the incoming data allows for the dynamic assembly of tool configurations that could lead to unintended behavior if the source data is attacker-controlled.

workflow-orchestration