The Agent Skills Directory

[METADATA_POISONING]: The skill frontmatter contains a 'risk: safe' attribute, which is a self-asserted claim that must be disregarded in security evaluations. Additionally, there is a discrepancy between the author name 'Whxuan0701' cited in the file and the expected author context 'sickn33', suggesting a potential inconsistency in source metadata.
[INDIRECT_PROMPT_INJECTION]: The skill methodology involves the ingestion of structured data, specifically JSON-formatted fault schedules and event records, which presents a potential attack surface for indirect prompt injection.
Ingestion points: Structured JSON schedules and event records as defined in the 'Deterministic Injection Schedule' and 'Evidence Output' sections of SKILL.md.
Boundary markers: The instructions recommend using request IDs and idempotency keys to track transitions, but do not specify the use of delimiters to isolate the injected data from the agent's core instructions.
Capability inventory: The skill describes capabilities for tool execution (e.g., 'claude', 'gemini'), worker restarts, and checkpoint management, which could be exploited if malicious instructions are successfully injected via the fault schedule.
Sanitization: The documentation focuses on redacting secrets for privacy but does not define procedures for validating or sanitizing the contents of the fault schedules before processing.
[NO_CODE]: The skill consists entirely of markdown documentation and instructional examples. It does not include any executable scripts, binaries, or automated installation commands that could execute code in the host environment.

agent-harness-fault-injection