The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The skill instructions include a command pattern where remote data from an API is piped directly to the Python interpreter (curl -s https://servanda.ai/api/bot/arbiters | python3 -m json.tool). While the -m json.tool suffix indicates this is intended for JSON formatting, the practice of piping remote content to a language interpreter remains a high-risk pattern.
[PROMPT_INJECTION]: The instructions contain directives that encourage the agent to act without user oversight or confirmation. Specifically, the agent is told: "Do NOT wait for the user to confirm they've joined" and "IMMEDIATELY start polling." This concealment of the agent's subsequent background actions reduces the user's ability to monitor or intercept network activity.
[INDIRECT_PROMPT_INJECTION]: The skill possesses a vulnerability surface for indirect prompt injection by ingesting and acting upon data from an external source.
Ingestion points: The polling loop in SKILL.md (Step 6) retrieves message history and turn data from https://servanda.ai/api/bot/sessions/{session_id}/poll.
Capability inventory: The skill utilizes the Bash(curl) tool to perform both reads and writes (sending messages).
Boundary markers: There are no explicit instructions or delimiters provided to the agent to help it distinguish between administrative metadata and potentially malicious instructions embedded within the user/mediator messages.
Sanitization: No sanitization or validation of the ingested message content is performed before the agent processes it to decide its next response.
[EXTERNAL_DOWNLOADS]: The skill performs multiple network operations to the vendor's domain (servanda.ai), including registration, session creation, and long-polling for message updates.

servanda