The Agent Skills Directory

[METADATA_POISONING]: The skill provides numerous documentation links that are labeled as "Apple" (e.g., "Apple: AdAttributionKit", "Apple: Verifying a postback") but resolve to the unofficial, third-party domain sosumi.ai. This is deceptive and leads users and agents to trust instructions from a non-authoritative source that mimics official documentation.
Evidence: Reference URLs in SKILL.md and references/adattributionkit-patterns.md point to https://sosumi.ai/... instead of developer.apple.com.
[INDIRECT_PROMPT_INJECTION]: The skill describes processes for ingesting data from external ad networks (JWS impressions) and user devices (postbacks), creating a vulnerability surface where malicious instructions could be embedded in the processed data.
Ingestion points: The jwsString parameter in the PostbackVerifier.verify function (references/adattributionkit-patterns.md) and the signedJWS parameter used to initialize AppImpression (SKILL.md).
Boundary markers: No explicit delimiters or instructions are provided to the agent to treat the content of the decoded JWS payloads as untrusted or to ignore instructions contained within them.
Capability inventory: The provided code snippets are limited to measuring and registering conversions; they do not currently expose dangerous tools or system commands that could be triggered by the processed data.
Sanitization: The skill correctly implements JWS signature verification using CryptoKit to ensure data authenticity and integrity, which helps verify the source but does not sanitize the actual data content against prompt injection.

adattributionkit