The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection because it processes untrusted data from external sources.
Ingestion points: Untrusted data enters the agent context through the list_client_invoices, list_transactions, and get_client tools (SKILL.md).
Boundary markers: The instructions include a manual override warning the agent to treat all tool-returned text as data and ignore embedded requests, though no structured delimiters are utilized.
Capability inventory: The skill has the ability to write to the financial system (mark_client_invoice_as_paid) and the communications system (create_draft via Gmail).
Sanitization: The skill explicitly requires the agent to escape returned text in generated outputs and use safe APIs like textContent for HTML generation.
[DYNAMIC_EXECUTION]: The skill generates dynamic HTML dashboards to visualize financial data. This represents a dynamic content generation surface. The skill provides remediation guidance to prevent script injection by prohibiting the use of innerHTML and executable JavaScript, and requiring that all dashboards be self-contained without external network dependencies.

qonto-invoice-chaser