The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill implements a workflow susceptible to indirect prompt injection by processing untrusted external content and using it to guide local file exploration. • Ingestion points: Data enters via the WebFetch command in SKILL.md (Step 1) which retrieves fields from arbitrary, user-supplied URLs. • Boundary markers: There are no delimiters or instructions to ignore embedded commands when the fetched fields are passed to the search agent in Step 2. • Capability inventory: The skill employs Agent (Explore), Read, Grep, and Glob tools with broad access to the user's local knowledge base. • Sanitization: No sanitization, escaping, or validation of the external form content is performed before interpolation into the agent's context.
[DATA_EXPOSURE_AND_EXFILTRATION]: The skill's primary function involves reading sensitive local information from paths such as **/profile/**, **/bio/**, MEMORY.md, and official.md. While this behavior is consistent with the skill's purpose for form filling, the lack of isolation between untrusted web inputs and these sensitive files creates a risk of unauthorized data discovery or summary creation if an indirect prompt injection occurs.

lov-fill-web-form