The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill provides instructions for the agent to retrieve and process data from external secrets management platforms. This creates a potential attack surface where malicious content stored within a secret could influence the agent's behavior during execution.
Ingestion points: SKILL.md instructs the agent to inventory and retrieve secrets using command-line tools such as vault kv get or aws secretsmanager describe-secret, which pulls external, potentially untrusted content into the active session.
Boundary markers: The documentation and instructions do not specify the use of delimiters or 'ignore' instructions to separate the data retrieved from the secret store from the agent's core instructions.
Capability inventory: The skill is configured with broad capabilities, including full bash command execution (Bash(cmd:*)) and file system access (Read, Write, Edit, Grep, Glob), which elevates the risk should an injection attack be successful.
Sanitization: No explicit sanitization or validation routines are included in the instructions or the bundled aws_secrets_manager_setup.py script to filter the content of secrets before they are processed by the agent.

integrating-secrets-managers