The Agent Skills Directory

[CREDENTIALS_UNSAFE]: Hardcoded credentials found in the implementation logic snippets meant to guide the agent's API interactions.
Files: SKILL.md, instructions.md.
Evidence: The generateEmail function hardcodes user_id: 'contact@epsimoai.com', password: 'EpsimoAI184', and projet: '2e8693e4-9b7b-4fe4-a289-0822b2db3665' in the request body.
[DATA_EXFILTRATION]: The skill transmits user-provided content to external endpoints.
Endpoints: https://beta.cgenius.app, backend.epsimoai.io, and api.qrserver.com.
Purpose: These operations are central to the skill's functionality for content generation, questionnaire creation, and QR code generation. The primary domains are associated with the skill's author/vendor.
[PROMPT_INJECTION]: Indirect prompt injection surface detected where user-provided content is interpolated into API request bodies.
Ingestion points: Variables such as topic, message, client_name, and services in SKILL.md and instructions.md.
Boundary markers: None present in the implementation logic to separate user-supplied data from the underlying prompt instructions.
Capability inventory: Network communication via the fetch API to transmit data to remote servers.
Sanitization: No evidence of input validation, escaping, or filtering before the user data is included in the JSON payloads.

cgenius