The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill documents AI tools (e.g., get_workouts and get_nutrition) that return health records containing user-modifiable string fields such as Title and Name. These fields could potentially be used by an attacker to host malicious instructions intended to manipulate the behavior of an AI agent processing the health data.
Ingestion points: WorkoutResult.Title and NutritionResult.Name properties defined in the structured records section of SKILL.md.
Boundary markers: The skill instructions do not provide delimiters or instructions for the agent to ignore potentially malicious embedded content within data results.
Capability inventory: The skill enables reading and writing of sensitive personal health information (PHI) but does not include network exfiltration or shell access tools.
Sanitization: No sanitization or validation logic for external record content is described in the integration guide.
[DATA_EXFILTRATION]: The skill provides the necessary configuration and API instructions to access highly sensitive personal information, including heart rate, blood pressure, oxygen saturation, and reproductive health data (cycle tracking).
Evidence: API reference for IHealthService and manifest configurations for Apple HealthKit and Android Health Connect.
Context: The access to sensitive data is the primary purpose of the skill and is protected by mandatory platform-level user consent prompts.

shiny-health