The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted user-supplied text (LinkedIn posts, comments, and DMs) to perform complex linguistic transformations. It possesses significant capabilities, including the ability to write persistent voice profile files to parent directories (../../references/voice-profile.md) and perform network operations via external scripts and libraries. The instructions lack explicit boundary markers or sanitization steps for the ingested content, creating a surface for indirect prompt injection where malicious instructions in the input text could potentially influence agent behavior.
Ingestion points: Ingests any text (posts, comments, DMs) in SKILL.md and writing samples in sub-skills/voice-profile.md.
Boundary markers: Absent; no delimiters or "ignore embedded instructions" warnings are specified for the untrusted input.
Capability inventory: File writing to ../../references/voice-profile.md, network access via scripts/test_detectors.py, and library-based network calls for image generation and profile fetching (lib.illustrate, lib.ApifyClient).
Sanitization: Absent; the skill performs regex-based transformations but does not sanitize content against instruction-overriding patterns.
[DATA_EXFILTRATION]: The detector-tester sub-skill and the scripts/test_detectors.py script transmit the full content of user-supplied drafts to multiple third-party services (GPTZero, Originality.ai, ZeroGPT, Sapling, and Copyleaks) for AI detection. While this is a documented feature and requires user-provided API keys, it involves sending potentially sensitive or confidential unpublished text to external entities over the network.
[COMMAND_EXECUTION]: The skill instructions direct the agent to execute a local Python script (scripts/test_detectors.py) to perform its parallel detection workflow. This script makes outbound network requests to various AI detection APIs.

linkedin-humanizer