The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill implements a workflow that accepts untrusted user input and processes it through various background workers without proper sanitization.
Ingestion points: User data is ingested via API routes (e.g., app/api/users/route.ts) and passed into the email, image-processing, and webhook queues.
Boundary markers: The implementation lacks delimiters or system instructions to ensure the agent ignores potentially malicious commands embedded in the variables, payload, or operations data fields.
Capability inventory: The workers possess capabilities to perform network requests (fetch), write to cloud storage (AWS S3), and process images using local file paths.
Sanitization: No validation or escaping is applied to external content before it is used in email rendering or webhook delivery.
[COMMAND_EXECUTION]: The ImageWorker allows for dynamic file path access during processing operations using user-supplied parameters.
Evidence: In workers/image.worker.ts, the watermark operation directly uses op.params.watermarkPath in the image.composite call.
Risk: If the watermarkPath is derived from untrusted input, it could be exploited for unauthorized file access or directory traversal.
[DATA_EXFILTRATION]: The WebhookWorker implementation facilitates network requests to arbitrary destinations.
Evidence: workers/webhook.worker.ts uses fetch(url, ...) where url is supplied by the job data.
Risk: This creates a Server-Side Request Forgery (SSRF) surface that could be used to exfiltrate data or probe internal network resources.
[EXTERNAL_DOWNLOADS]: Fetches the official software development kit from Amazon Web Services (AWS).

queue-job-processor