The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill includes Python scripts that ingest and process external data sources such as supplier ESG metrics, spend data, and category impact scores. \n
Ingestion points: Data is passed into the SustainableSourcingManager and SustainableTCO classes via methods like assess_supplier_esg(esg_data), calculate_sustainable_sourcing_score(spend_data), and calculate_tco(supplier_options). \n
Boundary markers: The instructions and code do not implement explicit delimiters or 'ignore embedded instructions' directives for the ingested data, creating a theoretical surface for instruction injection if the data sources are attacker-controlled. \n
Capability inventory: The skill's capabilities are restricted to numerical calculations and data manipulation using pandas and numpy. It does not perform network operations, file system writes, or dynamic code execution, which mitigates the risk of injection exploitation. \n
Sanitization: There is no data validation or sanitization logic in the provided scripts to filter non-numeric or potentially malicious content from the input dictionaries.

sustainable-sourcing