The Agent Skills Directory

File System Write Consideration: The scripts/rest_request.py script includes a feature to save raw API data to a path specified by the raw_output_path parameter. This allows for writing content to arbitrary directories where the agent has permissions, which could be used as a vector for persistence or unauthorized file modification if the path is not strictly controlled.
External Data Processing Surface: The skill ingests and processes content from an external REST API, creating a potential surface for indirect prompt injection. Since the skill also has file-write and network capabilities, there is a possibility that instructions embedded in the external data could attempt to trigger unintended actions. Ingestion points: Data is fetched from a remote endpoint in scripts/rest_request.py using the requests library. Boundary markers: No explicit delimiting markers or instructions to ignore embedded commands are used when presenting data to the agent. Capability inventory: The scripts/rest_request.py script performs network operations and file system writes. Sanitization: The script performs basic string truncation for display purposes but does not sanitize or filter the content of the API response for potentially malicious instructions.

ipd-skill