The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from the WordPress site being audited, which could contain malicious instructions designed to influence the agent's behavior.
Ingestion points: Audit results from respira_run_security_audit (SKILL.md), specifically the indicators block and its nested evidence and note fields which contain text from the target site.
Boundary markers: No specific delimiters or "ignore embedded instructions" warnings are provided for the audit evidence.
Capability inventory: The skill has significant write capabilities, including updating plugins (respira_update_plugin), themes (respira_update_theme), WordPress core (respira_update_core_security), and revoking administrator credentials (respira_revoke_application_password).
Sanitization: No explicit sanitization or validation of the audit data is mandated before it is used to plan or execute fixes.
[DATA_EXFILTRATION]: The skill performs telemetry by sending usage data to the vendor's API endpoint (https://www.respira.press/api/skills/track-usage). The transmitted data includes site and version context, duration, indicator counts, and fix statistics. This represents a network operation to a domain that is not on the standard whitelist, although it is the author's own domain.

wordpress-security-review