The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill serves as a repository for external security data, including evidence strings and crash logs, which are stored in data/findings.json. While the skill itself does not execute or interpret this data beyond storage, the stored content is not sanitized, creating a surface for indirect prompt injection if other agents or scripts process the resulting JSON file without proper validation.
Ingestion points: The add and update commands in scripts/findings.py accept arbitrary strings for fields like evidence, summary, and note.
Boundary markers: No explicit delimiters or warnings are used when storing or retrieving the data.
Capability inventory: The script is limited to local file system read/write operations for the JSON tracker.
Sanitization: The script performs basic whitespace normalization but does not filter for malicious instructions or control sequences.

finding-tracker