The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill features an 'Insufficient Data Fallback' workflow where the agent fetches raw product reviews using the reviews-raw command and processes them locally to generate insights. This creates a surface for indirect prompt injection, as an attacker could leave a review containing instructions designed to hijack the agent's behavior during the Map/Reduce phase.
Ingestion points: Untrusted review text fetched via the reviews-raw command in the zoodata.py script and passed to the agent.
Boundary markers: The render_review_map_prompt function in zoodata.py wraps the untrusted review text in triple quotes ("""), which provides minimal isolation against adversarial content.
Capability inventory: The agent can execute numerous subcommands in the zoodata.py script, perform network operations to the ZooData API, and write files to the local file system.
Sanitization: The script truncates review text to 500 characters before interpolation, which limits the payload size but does not filter for malicious instructions.
[COMMAND_EXECUTION]: The bundled Python script zoodata.py contains a call to subprocess.Popen used to manage temporary file cleanup. This function spawns a detached background process that re-executes the script itself with a specific --cleanup-stale-results flag to remove expired result directories. The execution is restricted to the script's own path.
[DATA_EXFILTRATION]: The script is designed to read the ZOODATA_API_KEY from ~/.zoodata/config.json and include it in the Authorization header of network requests. While this involves accessing a sensitive file path and sending credentials over the network, these operations are performed against the vendor's own official API (api.zoodata.ai) and configuration files, representing the intended functionality of the tool.

amazon-review-intelligence-extractor