The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill presents a notable attack surface for indirect prompt injection because it facilitates the ingestion of untrusted data from external sources and grants the agent significant write capabilities.
Ingestion points: The agent can ingest external content through tools like list_posts and get_post, which retrieve existing post data. Additionally, features such as linkedin_list_mentionables and planned/future tools like linkedin_post_comments ingest content (names, comments) authored by third parties.
Boundary markers: The skill does not define specific delimiters or instructional guards to prevent the agent from accidentally executing instructions found within the ingested social media content.
Capability inventory: The agent has access to numerous tools for creating, updating, and interacting with content across ten social platforms (e.g., create_post, update_post, linkedin_create_comment, linkedin_create_reshare, linkedin_create_reaction), providing a path for malicious instructions to result in real-world actions.
Sanitization: While the documentation mentions sanitization for specific fields like API key names and platform-specific formatting rules, it does not describe a general strategy for sanitizing ingested social media data against prompt injection attacks.

publora-api