The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and prioritize instructions from external files (briefs), creating a surface for indirect prompt injection where malicious instructions in a document could override the agent's intended behavior.
Ingestion points: The skill instructions in SKILL.md under the section "The user's own brief" direct the agent to read all non-media files, including notes, guides, and scripts found in the working directory, Drive, or attachments.
Boundary markers: The instructions recommend quoting the brief in the "project record" but do not specify the use of robust delimiters or explicit warnings to ignore potential instructions embedded within those external documents.
Capability inventory: The agent has the capability to execute shell commands via Bash, perform network operations via curl, write to the filesystem, and invoke other specialized AI agents.
Sanitization: No sanitization, filtering, or validation of the content within the external briefs is mandated before the information is used to set the "message, audience, and must-shows" for the project.
[DATA_EXFILTRATION]: The skill instructions facilitate outbound network connections to external domains, which can be misused for data exfiltration.
Evidence: In references/HOST.md, the "Looking at an image" section explicitly instructs the agent to use curl -sL -o <file> "<url>" to download images from arbitrary URLs provided by the user or found in data. This allows for outbound GET requests to non-whitelisted domains.
[COMMAND_EXECUTION]: The skill directs the agent to interact with the system shell to execute local scripts.
Evidence: references/HOST.md provides instructions for "Running a skill's script," directing the agent to use the Bash tool to execute Python scripts located in the scripts/ directory (e.g., python3 scripts/keyframes.py).

picsart-video-rules