The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from external invoice files, which creates a risk of indirect prompt injection.
Ingestion points: Documented in SKILL.md (Step 2), where the agent is instructed to read text from PDFs and images.
Boundary markers: Absent. The instructions do not specify using delimiters or warnings to ignore embedded instructions when processing the extracted text.
Capability inventory: Documented in SKILL.md (Steps 1 and 5), the skill uses find, mkdir, cp, and mv to scan the filesystem, create directories, and reorganize files.
Sanitization: Absent. The instructions do not include steps to sanitize or validate the extracted information before using it to determine filenames or folder structures.
[COMMAND_EXECUTION]: The skill performs shell operations to manage the local file system.
Evidence: SKILL.md contains bash commands for finding files (find), creating directories (mkdir -p), and moving or copying files (cp, mv). While these operations are necessary for the skill's stated purpose, they represent the capability surface that could be exploited via injection.

invoice-organizer