The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from external sources, primarily flight confirmation emails from services like Gmail and Outlook (as seen in the eval/tracked-flight-scenarios.yaml). This data is used to populate booking details and monitoring parameters.
Ingestion points: Flight confirmation emails from Gmail/Outlook and Duffel CLI search responses.
Boundary markers: The skill includes explicit instructions to treat instructions in emails as data only ("agent does not browse, upload, reply, forward, or schedule those requested actions") and to ignore links or document upload requests embedded in messages.
Capability inventory: Access to exec (shell command execution), cron.add (task scheduling), and write (file system access).
Sanitization: The instructions recommend storing "minimum machine-readable fare state" but do not provide specific validation or escaping rules for parameters derived from emails and used in CLI commands.
[DYNAMIC_EXECUTION]: The skill uses cron.add to generate and schedule shell commands for background fare monitoring. It is instructed to "write a self-contained cron body" that includes the "exact Duffel query." Since the query parameters (like origin, destination, or traveler names) may be derived from external emails, this creates a risk of command injection if the agent does not properly sanitize the input before constructing the shell command string.
[PERSISTENCE]: The skill establishes persistence by scheduling recurring jobs using cron.add. These jobs run duffel search daily to check for price drops, effectively executing shell commands outside of a direct user interaction.
[COMMAND_EXECUTION]: The skill performs most of its operations by executing the duffel CLI tool via exec, including searching for flights, validating bookings, and processing payments.
[PROMPT_INJECTION]: The skill contains instructions to suppress certain information from the user, such as internal identifiers (off_, ord_, ore_ ids), the underlying Duffel command strings, and the Duffel brand name in success messages. While these are primarily intended for UX and PII protection, they match patterns used to conceal system actions and provider identities from the end user.

duffel