The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes external audit assessment data via the scripts/process.py tool. While the tool performs legitimate scoring, it represents a surface for indirect prompt injection if an agent is tasked with processing data from untrusted or attacker-controlled sources. Ingestion points: The script reads assessment data from a JSON file path provided as a command-line argument. Boundary markers: There are no explicit markers or instructions within the script to ignore or delimit potentially malicious instructions within the assessment fields (e.g., 'finding' or 'evidence' strings). Capability inventory: The script is capable of reading local files and writing the resulting report to a user-specified local file path. Sanitization: The script uses the standard json.load() library, which safely parses the data format but does not validate or sanitize the textual content against embedded instructions.

gdpr-compliance-audit