The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill ingests large volumes of untrusted text (court judgments) from an external API. This content could potentially contain adversarial instructions designed to manipulate the agent's behavior during analysis or summarization.
Ingestion points: Full judgment text (textContent) is retrieved from the https://www.saos.org.pl/api endpoint via the scripts/saos.py script and presented to the agent.
Boundary markers: The skill instructions lack explicit delimiters or instructions to the agent to treat the retrieved text as data only, increasing the risk that the model might follow instructions embedded within the case law.
Capability inventory: The agent has access to Bash, Read, Write, and WebFetch tools, which could be misused if a prompt injection attack is successful.
Sanitization: While the instructions suggest removing HTML tags for formatting, there is no semantic sanitization of the judgment content to neutralize potential injection attacks.
[COMMAND_EXECUTION]: The skill relies on executing a local Python script (scripts/saos.py) via the Bash tool to perform its operations. This involves shell invocation to handle API logic and formatting.
[DATA_EXFILTRATION]: The skill performs network requests to an external domain (www.saos.org.pl) that is not on the standard whitelisted domains for data safety. While this is the intended purpose of the skill, it represents outbound network activity that could be leveraged if the agent is compromised.

saos-orzecznictwo