The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from external workbooks and uses the output to perform write operations.
Ingestion points: The read step (using the xlsx skill) extracts data from an external spreadsheet referenced in the user request.
Boundary markers: No explicit delimiters or instructions to ignore embedded commands are present when passing the spreadsheet data from the read step to the summarize skill in the analyze step.
Capability inventory: The skill possesses the ability to append data to the original workbook (writeback step) and write to a local file (memorize step via memory_save).
Sanitization: While user_message inputs are escaped and truncated, the content of the spreadsheet itself is processed by the summarization model without sanitization, allowing potentially malicious instructions in the data to influence subsequent steps.
[PROMPT_INJECTION]: User-provided messages are interpolated into the task description for the xlsx skill.
Evidence: The read step includes {{ inputs.user_message | xml_escape | truncate(512) }} in its task prompt. Although the skill employs xml_escape and truncate as defensive measures, the direct inclusion of user-controlled text into a tool command represents a prompt injection surface area.

meta-spreadsheet-insight