The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill directs the agent to ingest and analyze external data sources such as source code, binaries, and configuration files. This creates an attack surface where malicious instructions could be embedded within the audited files to manipulate the agent's output or behavior.
Ingestion points: The 'Operational Workflow' in SKILL.md identifies entrypoints, trust boundaries, parsers, and configuration files as primary data inputs for auditing.
Boundary markers: The skill lacks definitions for boundary markers or explicit instructions to treat file contents as inert data, which increases the risk of the agent obeying embedded commands.
Capability inventory: The skill references integration with a suite of tools for binary disassembly, bundle recovery, and orchestration, which could be misused if an injection is successful.
Sanitization: There are no specific requirements for sanitizing or escaping content retrieved from external files before processing.
Mitigation: To manage this risk, developers should implement strict delimiters for external content and instruct the agent to ignore any natural language instructions found within analyzed code or binaries.

offensive-toctou