The Agent Skills Directory

[PROMPT_INJECTION]: The skill implements 'Proactive Research' patterns that instruct the agent to autonomously scan untrusted external data sources, including git logs, codebase changes via fff, and project documentation. This creates a surface for Indirect Prompt Injection, where an attacker could place malicious instructions in commit messages or files to influence the agent's subsequent reasoning or report generation.
Ingestion points: git log, codebase files via fff, internal documentation (qmd), and previous context (ctx).
Boundary markers: Absent; the instructions do not suggest using delimiters or 'ignore embedded instructions' warnings when processing this data.
Capability inventory: The agent can execute shell commands (git log, fff) and generate/render HTML with JavaScript.
Sanitization: Absent; there are no instructions to sanitize or validate the content retrieved from external sources before including it in analysis or HTML reports.
[COMMAND_EXECUTION]: The skill encourages the agent to self-direct exploration by executing shell commands such as git log and fff. While these are read-only operations, their autonomous execution combined with the ingestion of untrusted data increases the risk that the agent could be manipulated into performing unexpected actions based on the content it discovers.
[DYNAMIC_EXECUTION]: The skill provides templates for generating rich HTML reports that include embedded JavaScript (e.g., interactive questionnaires and scoring logic). This involves script generation and execution within the agent's environment. While the examples provided use simple templates, the technique could be used to execute more complex or malicious logic if the generated script is influenced by injected data.

capability-experiments