The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill ingests data from external artifact records which are then processed by the agent, creating a potential attack surface for indirect instructions.
Ingestion points: The skill fetches content from the YYLO Ledger via yy ledger artifact get and yy ledger artifact search as described in SKILL.md.
Boundary markers: There are no explicit instructions or delimiters defined to separate retrieved payload content from the agent's system instructions.
Capability inventory: The agent is empowered to create, search, and retrieve records using the yy CLI tool.
Sanitization: While the documentation mentions the ledger tool rejects known secret patterns and unsafe schemes, there is no evidence of sanitization specifically designed to prevent prompt injection from the retrieved data.
[COMMAND_EXECUTION]: The skill enables shell directives and uses the $ARGUMENTS placeholder to process user requests, which may involve executing shell commands.
The interpolation of $ARGUMENTS into a shell context with enable-shell-directives: true creates a risk of command injection if the user input is not properly sanitized or if the agent executes the input without sufficient validation of shell metacharacters.

artifact-yylo