The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes financial data retrieved from external sources, which represents a potential attack surface if transaction metadata contains malicious instructions.
Ingestion points: As described in SKILL.md, the workflow uses spending_summary and transaction_search to pull income and payment history from external records.
Boundary markers: The instructions do not define specific delimiters or guardrails to ensure the agent ignores potential instructions embedded within the financial data it processes.
Capability inventory: The skill includes the export_transactions tool, which provides a file-based output capability that could be targeted by successful injection.
Sanitization: There is no evidence of sanitization, filtering, or validation performed on the retrieved transaction strings before they are used in calculations or exported.

quarterly-taxes