The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and review untrusted text such as pull request bodies, tickets, and code comments. This processing loop creates a surface for indirect prompt injection.
Ingestion points: The skill reads external text files or standard input through the check.sh script, which is then processed by patterns.awk.
Boundary markers: The scripts and instructions do not define clear boundary markers or "ignore" instructions to separate the prose being reviewed from the agent's operational instructions.
Capability inventory: The skill uses check.sh to execute a local AWK script (patterns.awk) which performs file reads and pattern matching. The agent uses the output of these tools to make decisions on rewriting content.
Sanitization: While patterns.awk contains a whitelist for specific HTML tags in the tracker_placeholders function, there is no general sanitization of the input text to prevent malicious instructions embedded in the prose from influencing the agent's reasoning.
[DATA_EXFILTRATION]: The check.sh script accepts a --before argument which is passed to the AWK script. The AWK script uses getline line < before to read the entire content of the specified file for comparison purposes. In an adversarial scenario, an agent could be manipulated via prompt injection to provide sensitive system file paths (e.g., SSH keys or configuration files) to this argument, leading to the exposure of that data within the agent's context and findings.

writing-prose