The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill exhibits a vulnerability surface where untrusted data provided by the user (such as email bodies, subjects, or recipient addresses) is interpolated directly into a shell command execution.
Ingestion points: Input fields defined in the JSON schema within SKILL.md, specifically email_subject, email_body, and recipient_email.
Boundary markers: The data is placed inside a JSON string within a single-quoted shell argument for the refly skill run command. While single quotes provide some protection, there are no instructions for the agent to escape single quotes or shell metacharacters within the user-provided content.
Capability inventory: The skill has the capability to execute shell commands using the refly CLI tool and interact with external workflows on refly.ai.
Sanitization: The instructions lack explicit sanitization or validation steps to ensure that user input does not break out of the JSON structure or the shell command string.

outlook