The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes FHIR bundles from external payers which may contain untrusted text in fields like processNote or contentString. This data is ingested into the agent context without explicit boundary markers or sanitization, creating a potential surface where malicious instructions embedded in claims data could influence agent behavior.
Ingestion points: External FHIR bundles are received via a callback handler described in stages/7.3-callback-and-archive.md and parsed in stages/7.10-communication-and-payment.md.
Boundary markers: No specific delimiters or instructions to ignore embedded commands are present in the pseudo-code for processing text fields.
Capability inventory: The skill facilitates significant capabilities including network operations via an adapter client (stages/7.1) and database storage operations (stages/7.2).
Sanitization: The logic for reading message bundles does not explicitly specify sanitization or filtering for free-text fields.
[EXTERNAL_DOWNLOADS]: The scripts/fetch-package.sh script downloads a ZIP archive from a URL provided by the user at runtime. While the script incorporates integrity verification by checking sha256 hashes against a manifest, downloading external artifacts remains a potential vector for supply chain risks if the source is untrusted.
[DYNAMIC_EXECUTION]: The scripts/fetch-package.sh utility script executes an embedded Python script to perform manifest verification. Although the script's logic is transparent and focused on security verification, the pattern of dynamic language execution within shell scripts is noted as a capability for complex automation.

nhcx-builder