The Agent Skills Directory

[PROMPT_INJECTION]: The skill exhibits an indirect prompt injection surface by processing untrusted html_content to derive 'Extraction Strategies' and metadata for generated skills. An attacker could potentially craft specific HTML structures that influence the generated logic, leading to the creation of a skill that performs unintended actions when followed by the agent in future sessions. \n
Ingestion points: html_content in the input schema. \n
Boundary markers: No explicit delimiters or 'ignore' instructions are defined for the generation templates. \n
Capability inventory: The skill has the capability to write new SKILL.md files to the local file system. \n
Sanitization: Uses structural fingerprinting (BeautifulSoup) to ignore text content, which reduces but does not eliminate the risk of structure-based logic manipulation.
[COMMAND_EXECUTION]: The skill's primary function involves the automated generation and writing of new instruction files (SKILL.md) to the skills/learned/ directory. This dynamic creation of instruction sets from variable input is a form of runtime logic generation that could be used to store and persist malicious behaviors if the learning process is influenced by attacker-controlled data.

pattern-learner