The Agent Skills Directory

[PROMPT_INJECTION]: The skill implements a pipeline for ingesting untrusted CSV and Excel data into the agent's context without providing isolation or boundary markers between data content and instructions.
Ingestion points: File upload buffer processing in SKILL.md and StreamingCSVParser in references/csv-parsing.md.
Boundary markers: Absent. There is no logic to prevent the agent from interpreting data rows as commands.
Capability inventory: Database transactions (trx.insert), background task queuing (Bull), and outbound network requests.
Sanitization: Structural validation is present (MIME checks, type validators), but this does not prevent instructions embedded within the data from targeting the LLM.
[DATA_EXFILTRATION]: The implementation includes a webhook notification pattern that allows the destination URL to be defined by the input data or job configuration.
Evidence: await fetch(job.webhookUrl, ...) in SKILL.md under notifyImportComplete.
Risk: This constitutes a Server-Side Request Forgery (SSRF) vulnerability surface, potentially allowing an attacker to exfiltrate internal data or scan internal network resources.
[COMMAND_EXECUTION]: The provided code snippets demonstrate extensive capabilities for database interaction and background job execution.
Risk: If input sanitization or validation layers are bypassed, these capabilities could be used to perform unauthorized database operations or data manipulation.
[PROMPT_INJECTION]: Multiple reference files, including references/architecture-patterns.md and references/security-best-practices.md, consist of 150 sections each with highly repetitive filler text and redundant snippets.
Risk: This "context stuffing" technique can be used to hide malicious instructions or attempt to bypass detection by overwhelming the analysis window with redundant noise.

backend-bulk-import