The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection as it processes data from external, potentially untrusted sources.
Ingestion points: The skill gathers 'Support Tickets', 'Exit Feedback', and 'Engagement Data' (including notes and activity logs) as specified in references/inputs.md.
Boundary markers: There are no explicit instructions or delimiters (e.g., XML tags, triple quotes) to separate untrusted data from system instructions, nor are there warnings to ignore embedded commands.
Capability inventory: The skill possesses extensive capabilities through tools such as Bash, Write, Edit, and WebFetch (SKILL.md).
Sanitization: The instructions lack any requirement for the agent to validate, escape, or filter the content of ingested files or tool outputs before processing them.
[COMMAND_EXECUTION]: The skill is configured with the Bash tool in its SKILL.md frontmatter. While the instructions intend for this tool to be used for data analysis and file management, the presence of such a powerful tool in a skill that processes untrusted external data increases the risk that an indirect prompt injection could lead to the execution of arbitrary shell commands.

churn-autopsy