The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill exhibits a risk of indirect prompt injection due to its design of ingesting and acting upon untrusted data from multiple sources. Ingestion points: As described in the 'Connected and Living Document' and 'Voice-based User Input' sections of SKILL.md, the agent reads content from external knowledge folders like 'Reading/Articles' and 'Journal' and processes voice transcripts. Boundary markers: While the skill uses '%%' to identify user comments, there are no instructions for the agent to ignore potential commands or malicious instructions embedded within the text it is processing. Capability inventory: The skill is authorized to use 'Write' and 'Edit' tools, which provides a mechanism for an attacker to modify the user's filesystem if the agent obeys an injected command. Sanitization: No sanitization or validation of the ingested content is mentioned in the operational guidelines.

interactive-writing-assistant