The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from external sources which could be used to influence the agent's behavior.
Ingestion points: Processes session events, exceptions, and person properties retrieved via SQL and API calls in SKILL.md.
Boundary markers: Absent; the skill does not specify delimiters to isolate untrusted data during analysis or narrative summary generation.
Capability inventory: Has the ability to execute SQL (execute-sql), manage vision scanners (vision-scanners-create, vision-scanners-delete), and query error tracking.
Sanitization: Absent; no explicit validation or escaping of the ingested properties or exception messages is defined before they are processed.
[DYNAMIC_EXECUTION]: The skill generates and executes dynamic code (SQL) at runtime.
Evidence: Assembles SQL queries using string interpolation for parameters like $session_id and person_id in SKILL.md (Step 2 and Step 3).
Risk: Simple script generation from templates is used for standard data retrieval, but lacks explicit protection against command/query injection if inputs are not properly sanitized by the underlying tool interface.

investigating-replay