The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes user-supplied data in various context fields, creating a surface for indirect instructions to influence agent behavior.
Ingestion points: Untrusted data enters the agent context through the fields defined in the Input Context section of SKILL.md (e.g., protocol category, capital base, governance model).
Boundary markers: The skill lacks explicit delimiters or instructions to the agent to disregard instructions embedded within these user inputs.
Capability inventory: Across SKILL.md and the reference files (including references/defi-risk-management.md and references/yield-strategies.md), the skill provides code generation templates in Solidity, Python, and TypeScript. It does not perform subprocess calls, network operations, or file system modifications.
Sanitization: No input validation, filtering, or sanitization logic is specified for the input context fields.
[METADATA_POISONING]: The files references/blockchain-defi-ref-1.md and references/blockchain-defi-ref-2.md exhibit highly anomalous redundancy, repeating the same blocks of mathematical formulas and text dozens of times. While no hidden malicious instructions were found in the repeated content, this pattern is deceptive and can be used as a context-stuffing technique to manipulate the agent's context window or degrade performance.

blockchain-defi