The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data ingested from security findings which can contain malicious instructions hidden in resource names or metadata.
Ingestion points: The skill uses subimageRunCypher to fetch Finding nodes from the graph database. These nodes contain display_name and fields_json fields populated from external cloud environments (e.g., AWS, Azure) which are under the control of potential attackers.
Boundary markers: There are no explicit instructions to the agent to use delimiters or to disregard embedded instructions when interpolating the display_name or data from fields_json into the final summary or notification payloads.
Capability inventory: The skill has access to subimageSendNotification (network communication to Slack/email) and subimageCreateTicket (ticketing system integration). If an attacker successfully injects instructions into a finding, they could potentially influence the content of these notifications or tickets.
Sanitization: The instructions do not specify any sanitization, escaping, or validation of the external content before it is processed by the agent to generate the triage digest.

triage-new-findings