The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill has an attack surface for indirect prompt injection as it ingests and processes untrusted data from character profiles and knowledge documents.
Ingestion points: Untrusted data enters the agent context through the get_avatar, list_avatar_knowledge_documents, and get_avatar_knowledge_document tools as described in SKILL.md.
Boundary markers: No explicit boundary markers or instructions to ignore embedded commands are present in the processing logic.
Capability inventory: The skill possesses capabilities to create_avatar, update_avatar, and manage knowledge documents, allowing for state changes based on processed data.
Sanitization: There is no mention of sanitization, validation, or escaping of the content retrieved from character metadata or documents.
[EXTERNAL_DOWNLOADS]: The skill fetches configuration and documentation from external sources.
The skill downloads developer guidelines and technical specifications from docs.dev.runwayml.com.
The skill references the runwayml/avatar-sdk-react repository on GitHub for implementation details.
[DATA_EXPOSURE_AND_EXFILTRATION]: The skill instructions involve the handling of sensitive environment variables.
The agent is instructed to "probe RUNWAYML_API_SECRET without printing it" in SKILL.md. Although it explicitly forbids printing the secret, the act of accessing it within the execution context constitutes a potential exposure risk.

runway-dev-characters