The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill ingests data from a shared state engine, which creates an attack surface where malicious actors could inject instructions into the agent's context through shared entity properties.\n
Ingestion points: External data enters the agent's environment via the get and list commands in scripts/flux.sh (as documented in SKILL.md).\n
Boundary markers: The instructions in SKILL.md lack specific delimiters or warnings to the agent to treat data retrieved from the Flux API as untrusted or to ignore any natural language instructions embedded within that data.\n
Capability inventory: The skill provides capabilities for network operations (curl via scripts/flux.sh) and file system access (inherent to the agent context), which could be abused if an injected instruction is followed.\n
Sanitization: There is no evidence of sanitization or filtering of the content retrieved from the API before it is processed by the agent.\n- [COMMAND_EXECUTION]: The core functionality of the skill is provided through a bash script (scripts/flux.sh) that executes shell commands and makes network requests.\n
Execution method: The script uses curl to interact with the Flux API at https://api.flux-universe.com (or a user-defined FLUX_URL).\n
Injection surface: Arguments passed by the agent to the publish and batch commands are interpolated into JSON payloads within the script, which could potentially lead to malformed commands or JSON injection if inputs are not carefully managed by the agent.

flux