The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill documents a significant attack surface for indirect prompt injection by facilitating the interpolation of external, untrusted data (from trigger payloads, subscriber profiles, and previous step responses) into notification templates and workflow logic.
Ingestion points: Untrusted data enters the agent context through the payload.*, subscriber.*, and steps.<http-step-id>.* namespaces.
Boundary markers: The skill uses Liquid syntax {{ ... }} for interpolation and JSONLogic for execution conditions, providing structural but not adversarial delimiters.
Capability inventory: The documented capabilities include creating HTTP Request steps (network operations) and Step Conditions (execution flow control).
Sanitization: There are no instructions for the agent to sanitize or validate external content before it is processed by the Liquid engine or used in request parameters.
[DATA_EXFILTRATION]: The guidelines for the HTTP Request step explicitly allow the target URL to be defined via a template variable (e.g., "{{payload.webhookUrl}}"). This configuration enables a data exfiltration vector where a malicious event trigger could specify an attacker-controlled endpoint to receive sensitive payload or subscriber data.
[CREDENTIALS_UNSAFE]: The skill correctly defines NOVU_SECRET_KEY as a secret type in its frontmatter, which is an appropriate practice for managing sensitive API keys. Furthermore, it explicitly instructs the agent to avoid hardcoding secrets directly into workflow steps, recommending the use of variables instead.

novu-dashboard-workflows