The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from long-running missions, creating an attack surface where instructions embedded in logs or files could influence the controller behavior.
Ingestion points: Data enters through tools like get_mission_events, get_mission_diagnostics, and download_shared_file as defined in the monitoring loop.
Boundary markers: There are no explicit delimiters or specific prompt-injection warnings used when interpolating mission transcripts or diagnostics into the agent's context.
Capability inventory: The agent can influence its environment via tools like start_mission, resume_mission, and workspace_bash, which could be abused if the controller is influenced by external mission output.
Sanitization: While the skill lacks explicit sanitization functions, it enforces a design principle of using verifiable end-states and minimal hints, which acts as a structural mitigation against accidental obedience to embedded instructions.

hermes-mission-control