The Agent Skills Directory

[PROMPT_INJECTION]: Indirect Prompt Injection Surface. The skill is designed to fetch content from external URLs using the WebFetch tool and read local project files (such as PRODUCT.md and DIRECTION.md) to guide its analysis and content generation. This untrusted data is then processed in a context where the agent has significant capabilities, including executing arbitrary Node.js or Python code via the Bash tool and writing to the local filesystem. Malicious instructions hidden within the HTML of a scanned website or the content of project files could potentially manipulate the agent into executing unauthorized commands or writing malicious files.
Ingestion points: Untrusted data enters the agent context via the WebFetch tool (used in references/audit.md, references/page.md, etc.) and the Read tool (used to parse project-specific instructions in SKILL.md).
Boundary markers: The skill lacks instructions for the agent to use delimiters or ignore potentially malicious instructions embedded within the data it fetches.
Capability inventory: The skill explicitly allows high-privilege tools such as Bash(node *), Bash(python3 *), and Write, which could be exploited if the agent follows instructions from an external source.
Sanitization: There are no specified sanitization or validation routines for external content before it is processed or used to influence agent behavior.

seo