The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill fetches content from external sources (company RSS/Atom feeds and SEC filings) and instructs the agent to summarize and process this data. This creates a surface for indirect prompt injection where an attacker could embed malicious instructions in a company's feed to influence the agent's behavior when generating the brief.
Ingestion points: The brief.py script fetches data from remote URLs specified in companies.json or provided via the --feed argument, as well as SEC filing data from data.sec.gov.
Boundary markers: The skill does not employ specific delimiters or "ignore instructions" warnings to encapsulate the fetched external content before it is presented to the agent for processing.
Capability inventory: The brief.py script has the capability to write and modify files in the hunter/companies/ directory.
Sanitization: The skill performs XML parsing for feeds but does not sanitize or filter the text content of those feeds for potentially malicious instructions before interpolation into the markdown brief.
[DATA_EXFILTRATION]: The skill requests and stores the user's name and email address in a local profile file, which is then sent as a User-Agent header in network requests to the SEC EDGAR system. While this is a documented requirement for complying with the SEC's access policies, it involves the transmission of personally identifiable information (PII) to an external server.
Evidence: brief.py reads the sec_user_agent from hunter/profile.json and uses it as the User-Agent header when calling urllib.request.urlopen for URLs targeting data.sec.gov.

hunter-research