The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted user input in the form of boycott reasons and interpolates this data directly into shell commands via curl.
Ingestion points: User conversational input extracted for the "reason" field in SKILL.md.
Boundary markers: The instructions lack explicit delimiters or warnings for the agent to ignore embedded instructions within user-provided text.
Capability inventory: The skill is configured with Bash(curl:*) permissions to execute shell commands.
Sanitization: There are no instructions for sanitizing or escaping special shell characters (e.g., semicolons, backticks, or quotes) within the user-supplied string before it is passed to the shell.
[COMMAND_EXECUTION]: The skill dynamically constructs shell commands using curl to interact with a local API (http://127.0.0.1:7847). The instruction to "Keep the reason in the user's voice — don't paraphrase" encourages the verbatim inclusion of potentially malicious user input into the shell environment, creating a potential vector for command injection.

boycott-filter