The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill references unofficial third-party resources for integration, including a GitHub repository (mohamad-zatar/saudi-nafath-integration) and a Postman collection (crimson-crater-793597/yakeen-collection) that are not from recognized vendors.
[COMMAND_EXECUTION]: The skill provides curl command templates for interacting with external API endpoints using environment-stored tokens and user-provided identification data.
[PROMPT_INJECTION]: The skill exposes an indirect prompt injection surface due to its handling of untrusted data: 1. Ingestion points: Identification data such as nationalId, nin, and dateOfBirth are ingested from the user context. 2. Boundary markers: There are no delimiters or instructions to treat user-supplied values as data only, which could allow the agent to misinterpret embedded instructions. 3. Capability inventory: The skill uses curl to perform network requests based on this input. 4. Sanitization: The provided templates lack logic for validating or escaping user input before its inclusion in shell-based network requests.

saudi-identity