The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted page data to generate schema markup, creating a surface for indirect prompt injection attacks.
Ingestion points: Data is ingested through the data and faqs arguments in functions such as generateArticleSchema and generateFAQSchema defined in SKILL.md.
Boundary markers: There are no explicit boundary markers or instructions to the agent to treat input fields (e.g., headline, description, faq.answer) as inert data, which could allow instructions embedded in metadata to influence the agent.
Capability inventory: The skill environment allows the use of powerful tools including Bash, Write, and Edit, which could be exploited if an attacker-controlled page content triggers a malicious response from the agent.
Sanitization: The implementation relies on JSON.stringify for output, which does not sanitize natural language content for potential prompt injection payloads and does not prevent XSS (via </script> tags) if the resulting code is deployed.

pseo-schema