The Agent Skills Directory

[PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection (Category 8) because it reads and processes content from external files that are not controlled by the user or the agent. An attacker could embed malicious instructions within an invoice to manipulate the agent's behavior.
Ingestion points: The skill extracts text from PDFs and images (receipts/invoices) as described in the 'What This Skill Does' and 'Instructions' sections.
Boundary markers: There are no mentioned delimiters or instructions to ignore embedded commands within the extracted invoice text.
Capability inventory: The skill has the ability to execute file system operations (find, mkdir, cp, mv) which could be abused if an injection is successful.
Sanitization: There is no evidence of sanitization or validation of the extracted text before the agent processes it.
[COMMAND_EXECUTION]: The skill utilizes shell commands to perform its primary function of file organization.
Evidence: Uses bash commands such as find . -type f, mkdir -p, cp, and mv to locate, create directories for, and move/copy files. While these are intended for legitimate organization, they represent the capability surface that could be targeted via injection.

invoice-organizer