The Agent Skills Directory

[COMMAND_EXECUTION]: The skill makes extensive use of the subprocess module and direct shell execution to coordinate its workflow. It executes internal Python scripts (santa.py, catalog.py) and system utilities like curl to fetch listing data and process images. While these are necessary for the skill's operation, they expand the attack surface if inputs are not strictly validated.
[EXTERNAL_DOWNLOADS]: The skill connects to Amazon marketplace domains and short-link services (amzn.to, a.co) to retrieve product metadata and images. These network operations are intended and disclosed in the documentation, targeting well-known services for the skill's primary purpose.
[INDIRECT_PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection due to the way it handles external data.
Ingestion points: Product titles and gallery information are fetched from external Amazon HTML pages via scripts/santa.py (in the parse_listing function).
Boundary markers: The skill lacks clear delimiters or protective instructions when interpolating these externally sourced titles into the classification prompts.
Capability inventory: The agent has the ability to execute shell commands via subprocess, perform network requests via curl, and generate content via the image_gen tool.
Sanitization: There is no evidence of sanitization or filtering of the title string before it is formatted into the CLASSIFY_RULES prompt sent to the model in scripts/santa.py.

santa-skill