The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill possesses a vulnerability surface for indirect prompt injection as it is designed to ingest and process content from untrusted external folders or repository URLs.
Ingestion points: The skill reads SKILL.md, README, and various script files from a local directory or a public repository URL specified by the user at runtime.
Boundary markers: The instructions lack explicit boundary markers or directives to ignore instructions embedded within the analyzed content, which could allow malicious instructions in the target files to influence the agent.
Capability inventory: The skill is authorized to use curl for network requests and can read arbitrary files within the specified skill folder.
Sanitization: No sanitization or filtering is performed on the content read from external skill files before it is processed by the agent.
[DATA_EXPOSURE_AND_EXFILTRATION]: The skill accesses a local credential file to retrieve an API key for its primary publishing function.
Evidence: In SKILL.md, Step 6 contains a bash script that reads the ~/.varg/credentials file to extract an api_key for authentication.
Context: The extracted credentials are sent to https://api.varg.ai/v2/skills/submissions. As varg.ai is the official domain associated with the skill author (varghq), this behavior represents standard vendor-specific functionality for authentication rather than malicious exfiltration.

varg-publish-skill