The Agent Skills Directory

[COMMAND_EXECUTION]: The skill requires the agent to execute a local Python script scripts/atoms-search.py using python3 to retrieve risk definitions and evidence. This involves spawning a local process with arguments derived from user content.
[DATA_EXFILTRATION]: The atoms-search.py script transmits user-provided search queries to an external endpoint (https://api.xyskill.xyz/v1/atoms/search). Although this is used to fetch relevant risk data, it involves sending fragments of potentially sensitive user text to a third-party server.
[EXTERNAL_DOWNLOADS]: The skill fetches data from an external API (api.xyskill.xyz) to maintain an up-to-date knowledge base of platform regulations and risk mechanisms. This external dependency is used to augment the local atoms.jsonl file.
[INDIRECT_PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection through its data ingestion pipeline:
Ingestion points: Untrusted content submitted by users for risk checking (SKILL.md).
Boundary markers: The instructions lack explicit delimiters or 'ignore' warnings for the data returned by the search tool.
Capability inventory: The skill uses atoms-search.py which performs network requests and reads local configuration files (~/.xy/config.json).
Sanitization: While the script performs basic keyword splitting, the final output aggregated from external 'atoms' is processed by the agent without strict schema validation or sanitization, potentially allowing malicious content in the external API response to influence agent behavior.

xy-publish-guard