The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection because it ingests and processes untrusted data from external app store listings. An attacker could potentially place instructions in an app's description field to manipulate the agent's audit logic. * Ingestion points: Data is fetched from user-provided Apple and Google Play URLs in Phase 1 (SKILL.md). * Boundary markers: The skill extracts specific metadata fields which provides structure, but it lacks explicit directives to disregard instructions found within that data. * Capability inventory: The skill's capabilities are limited to report generation and recommendation; it lacks hazardous tools like direct shell execution or arbitrary file writes. * Sanitization: No specific content filtering or sanitization of the fetched data is described.
[EXTERNAL_DOWNLOADS]: The skill fetches data from well-known services such as apps.apple.com and play.google.com. This is intended behavior for its auditing functionality and uses trusted domains.

aso