The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is designed to process untrusted data provided by the user, such as Instagram analytics, screenshots, and retention metrics.
Ingestion points: User-provided text, pasted insights, and screenshots of post performance.
Boundary markers: The instructions do not specify delimiters to separate user data from the agent's instructions.
Capability inventory: The skill is restricted to analysis and reporting; it does not contain tools for network operations, file writing, or system command execution.
Sanitization: No explicit sanitization of the input data is performed, though the lack of executable capabilities mitigates the risk.
[DATA_EXPOSURE_AND_EXFILTRATION]: The skill accesses a local application file at ~/.claude/instagram/log.md to retrieve historical data about content hooks. This file access is restricted to the tool's own operational directory and does not target sensitive system files or credentials. No network exfiltration patterns were detected.

ig-audit