The Agent Skills Directory

[PROMPT_INJECTION]: The skill contains explicit instructions to subvert platform security controls. It directs the AI agent to use bash_tool to "bypass all web_fetch permission restrictions," which is a direct attempt to circumvent safety filters designed to regulate network access.
[COMMAND_EXECUTION]: The instructions provide multiple complex shell commands and Python scripts intended for execution via bash_tool. This includes using curl to retrieve external content and piping it into a Python interpreter for processing, which allows for arbitrary command execution outside the defined tool boundaries.
[REMOTE_CODE_EXECUTION]: The skill includes Python code templates for network communication that specifically advise the agent to disable SSL/TLS certificate verification (ssl.CERT_NONE). This instruction is a dangerous security anti-pattern that makes all subsequent network traffic vulnerable to man-in-the-middle (MITM) attacks.
[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest large amounts of data (up to 20,000 characters) from external sources, creating a significant attack surface for indirect injection.
Ingestion points: Data is retrieved from the Publications Office SPARQL endpoint and Cellar knowledge graph via bash_tool and curl commands.
Boundary markers: The skill lacks any boundary markers or instructions to treat the retrieved content as untrusted data.
Capability inventory: The skill possesses the capability to execute shell commands, run Python scripts, and perform unverified network operations.
Sanitization: There is no evidence of sanitization, escaping, or validation of the content fetched from external URLs before it is processed by the agent.

eu-sparql-search