The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill implements workflow logic that ingests and processes data from external sources, which constitutes a surface for indirect prompt injection.
Ingestion points: Data is received from messaging queues using ctx.queue.next() and loopCtx.queue.nextBatch(), as well as from external APIs via fetch() calls across several files including approval-gate.ts, batch-drainer.ts, and fan-in-out.ts.
Boundary markers: The code lacks explicit boundary markers or instructions to isolate or ignore potentially malicious instructions embedded in the ingested data.
Capability inventory: The skill has the capability to perform network operations and modify persistent workflow state through its core APIs.
Sanitization: There is no evidence of input validation or sanitization being applied to external data before it is used to drive workflow logic.
[DATA_EXFILTRATION]: The skill performs network requests to external domains not included in the standard whitelist.
Evidence: Multiple example files such as approval-gate.ts, fan-in-out.ts, and setup-teardown/index.ts use the fetch API to communicate with api.example.com and api.stripe.com.

rivet-workflows