The Agent Skills Directory

[DATA_EXFILTRATION]: The tools within tools.py allow for arbitrary network requests by accepting a user-configurable base_url parameter.
Evidence: The _resolve_base_url function explicitly allows the base_url argument to override environment configurations.
Risk: An agent could be manipulated via prompt injection to redirect API calls to an external malicious endpoint, effectively exfiltrating scheduled job definitions which contain sensitive message content, session IDs, and user IDs.
[PROMPT_INJECTION]: The skill facilitates indirect prompt injection by allowing the storage and scheduling of potentially malicious instructions in task payloads.
Ingestion points: Untrusted content enters the system via the prompt, text, and name parameters in the cron_create_job function within tools.py.
Boundary markers: There are no boundary markers or delimiters used to isolate user-provided content from the task configuration structure.
Capability inventory: The skill possesses the capability to perform network requests and schedule recurring agent or text-based tasks.
Sanitization: No input sanitization or verification is performed on the content stored in the scheduled jobs, allowing for the persistence of injection payloads.

cron