The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill retrieves content from an external source (Evernote) that can be controlled by an attacker or contain untrusted data.
Ingestion points: Methods in references/implementation-guide.md such as search, searchWithContent, and findRelatedNotes fetch data directly from Evernote note bodies and metadata.
Boundary markers: The instructions lack specific boundary markers or 'ignore' directives that would prevent the agent from accidentally executing instructions found within the retrieved notes.
Capability inventory: The skill environment allows for Read, Write, Edit, and Bash(npm:*) tool execution. A malicious note could attempt to trick the agent into using these tools to modify the local project or exfiltrate data.
Sanitization: There is no evidence of sanitization or filtering of note content to strip out potential instructions or malicious markdown before the data is presented to the agent.

evernote-core-workflow-b