The Agent Skills Directory

[COMMAND_EXECUTION]: The skill instructs the agent to execute shell commands (e.g., calling picture-record.py) that incorporate variables derived from user input or extracted image data, such as <detail> and <answer>. These variables are placed inside double quotes in a bash-mediated execution environment. This approach is vulnerable to command injection because shell metacharacters like backticks (`) or command substitutions ($()) are still evaluated inside double quotes, potentially allowing an attacker to execute arbitrary code on the underlying system.
[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process untrusted external image files, such as screenshots and ticket attachments, which provides a surface for indirect prompt injection attacks.
Ingestion points: Image files and attachments processed by the agent in Step 3 of the instructions.
Boundary markers: The instructions do not define any delimiters or provide guidance to the agent to distinguish between the image content and its own task instructions.
Capability inventory: The skill possesses the ability to execute system commands via the local picture-record.py script and can write data to a persistent record.
Sanitization: The skill lacks any explicit instructions for sanitizing or validating the text extracted from images before it is used in subsequent operations or shell commands.

read-picture