The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted external data from two primary sources: user-uploaded PPTX, DOCX, and PDF files, and results from web searches. This content is used to influence the generation of sales decks and proposals, creating a vulnerability surface where instructions embedded in the input data could potentially override agent behavior.
Ingestion points: User-uploaded files in /mnt/user-data/uploads/ and external content retrieved via web_search and web_fetch tools.
Boundary markers: The skill does not explicitly define delimiters or specific "ignore instructions" warnings for the content extracted from user files or the web.
Capability inventory: The skill has access to local command execution (scripts/extract_brand_style.py), network tools (web_search, web_fetch), and file generation libraries (pptxgenjs, docx).
Sanitization: While the extraction script attempts to use defusedxml for secure XML parsing, there is no evidence of sanitization or filtering for natural language instructions within the extracted text content before it is processed by the agent.
[COMMAND_EXECUTION]: The skill invokes a local Python script (scripts/extract_brand_style.py) to parse Office documents.
Evidence: The workflow in SKILL.md explicitly instructs the agent to run python scripts/extract_brand_style.py /mnt/user-data/uploads/<file> /home/claude/brand_style.json.
Context: The script uses standard libraries like zipfile and xml.etree.ElementTree to unpack and analyze style metadata. The use of subprocess.run in the companion scripts/test_extract_brand_style.py is limited to the testing environment.

sales-proposal-builder