The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill uses WebFetch and WebSearch to gather technical data from external sources such as documentation and source code repositories. This external content is processed to formulate recommendations, creating a surface for indirect prompt injection if an attacker hosts malicious instructions within those sources. 1. Ingestion points: WebFetch and WebSearch are used for external data; Read is used for local project files (SKILL.md). 2. Boundary markers: The instructions do not define clear delimiters or "ignore instructions" markers for external content. 3. Capability inventory: The skill has file system access (Read, Write, Glob, Grep) and network access (WebFetch). 4. Sanitization: No sanitization or validation of external content is described.
[DATA_EXFILTRATION]: The skill combines the ability to read from the local filesystem (including searching worktrees via Read, Glob, and Grep) with the ability to perform network operations (WebFetch). This capability chain presents a risk where sensitive local data could be exfiltrated if the agent is tricked into appending file contents to the URLs or payloads of its web requests.

researchkit