The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes data from external CloudKit and iCloud sources that could be used to inject malicious instructions into the agent's context. 1. Ingestion points: The skill reads external data via fetchedRecordZoneChanges in CKSyncEngineDelegate, NSUbiquitousKeyValueStore change notifications, and CKQuery result handling in SKILL.md and references/cloudkit-patterns.md. 2. Boundary markers: Absent; there are no instructions or delimiters to isolate untrusted external content from the agent's system prompts. 3. Capability inventory: The skill enables significant side effects including network writes via CKDatabase.save, atomic batch updates through CKModifyRecordsOperation, and local file manipulation with FileManager.moveItem. 4. Sanitization: Absent; fetched values are merged or printed without validation, escaping, or filtering.
[METADATA_POISONING]: The References section in SKILL.md provides links to sosumi.ai (e.g., https://sosumi.ai/documentation/cloudkit) while presenting them as official framework documentation. This is a third-party domain that imitates official Apple developer resources, which is deceptive and could lead to the ingestion of potentially modified or untrusted documentation.

cloudkit