The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from external sources and local files, creating a potential surface for indirect prompt injection.
Ingestion points: Fetches live app listing data via WebFetch from apps.apple.com and play.google.com. It also reads local context from .agents/product-marketing.md or .claude/product-marketing.md.
Boundary markers: The instructions do not specify explicit delimiters or "ignore" instructions when processing the fetched app descriptions or marketing context.
Capability inventory: The skill uses WebFetch for network retrieval and browser tools for capturing screenshots, but does not have file-write or shell execution capabilities.
Sanitization: No explicit sanitization or filtering of external content (like app descriptions) is mentioned before the data is processed for scoring and report generation.
Risk Factor: An attacker controlling an app listing could embed instructions in the description to influence the agent's audit results, though the impact is limited to the report's content.

aso