The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted external data from URLs, search results, and PDF files, creating a potential surface for indirect prompt injection attacks.\n
Ingestion points: Data enters through WebFetch (URLs), WebSearch (queries), and Read (local PDFs and files) as described in Workflows/Extract.md.\n
Boundary markers: No delimiters or explicit instructions are provided to the agent to treat external content as untrusted or to ignore embedded instructions.\n
Capability inventory: The skill is capable of writing files to ~/Documents/notes/ and executing local shell commands via curl and date.\n
Sanitization: There is no evidence of filtering or sanitization logic applied to the external content before it is processed by the agent.\n- [COMMAND_EXECUTION]: The skill instructs the agent to execute specific local shell commands for notification and metadata purposes.\n
Evidence: SKILL.md and Workflows/Extract.md contain instructions to run curl -s -X POST http://localhost:31337/notify for status updates and date for generating filenames and timestamps. These commands are static and do not incorporate variable user or network input into the shell execution string itself.

ljg-qa