The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill ingests data from external Kanban boards, repositories, and tasks, creating a potential vector for indirect prompt injection if the source data contains malicious instructions.
Ingestion points: Data enters the agent's context through realmroot toolbox get commands targeting agent-kanban/boards, agent-kanban/repositories, and agent-kanban/tasks as described in SKILL.md.
Boundary markers: The instructions do not specify any delimiters or ignore-instructions markers to protect the agent from embedded malicious content in the fetched JSON objects.
Capability inventory: The agent possesses write and modification capabilities via realmroot toolbox post and patch commands, which could be manipulated by an attacker who places instructions in task fields.
Sanitization: There is no mention of sanitizing, filtering, or validating the external content before it is used to inform the agent's actions or the creation of new tasks.

ak-task