The Agent Skills Directory

[PROMPT_INJECTION]: The skill presents an indirect prompt injection surface as it processes untrusted data from an external source.\n
Ingestion points: Data enters the agent's context through api_get functions in scripts/luma_calendar.py, which retrieve event descriptions and guest lists from the Luma API.\n
Boundary markers: There are no explicit delimiters or system instructions provided to help the agent differentiate between data and potentially malicious commands embedded within the retrieved content.\n
Capability inventory: The skill can perform write actions such as creating events and adding guests via the api_post function, which could be exploited if the agent is misled by injected instructions.\n
Sanitization: The script outputs raw JSON from the API, providing no filtering or sanitization of string values before they are processed by the agent.

luma-calendar