The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection because it interpolates untrusted data from command-line arguments and local files directly into prompts sent to external AI models. \n * Ingestion points: Positional text arguments in extract.js, sentiment.js, and summarize.js; prompt arguments in vision.js; and file contents read via the --file flag in summarize.js or local image paths in vision.js. \n * Boundary markers: Prompts use basic labels (e.g., "Text to summarize:", "Text:", "Schema:") to separate user input from system instructions, but these lack robust delimiters or specific instructions to ignore embedded commands. \n * Capability inventory: The skill has the ability to read and write files (fs.readFileSync, fs.writeFileSync) and perform network requests to external APIs via fetch. \n * Sanitization: No sanitization, escaping, or validation is performed on input text or file content before it is included in AI prompts.\n- [DATA_EXFILTRATION]: The scripts transmit user-provided text, images, and file contents to well-known AI service providers, including Anthropic and OpenAI. While these are trusted services, users should be aware that data is processed externally.\n- [COMMAND_EXECUTION]: The skill consists of multiple Node.js scripts that execute local file and network operations when invoked by the user or an agent.

ai-tools