The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes DICOM files from external sources, creating a potential surface for indirect prompt injection. Malicious instructions could be embedded within DICOM metadata tags (such as PatientName, StudyDescription, or PatientComments) that an AI agent might interpret as instructions rather than data when processing the file metadata.
Ingestion points: Untrusted data enters the agent context via pydicom.dcmread() calls found in SKILL.md, scripts/extract_metadata.py, scripts/anonymize_dicom.py, and scripts/dicom_to_image.py.
Boundary markers: The provided scripts do not utilize specific delimiters or boundary instructions to signal to the agent that extracted metadata strings should not be treated as executable instructions.
Capability inventory: The skill possesses the capability to write files to the local system (ds.save_as) and perform image transformations, which could be misused if an agent is successfully manipulated.
Sanitization: The format_value function in scripts/extract_metadata.py handles basic data type conversion and byte decoding (using errors='ignore'), but does not provide content-level sanitization or filtering for prompt injection patterns.

pydicom