The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is designed to process and validate untrusted JSON data and schemas, creating a significant surface for indirect prompt injection.
Ingestion points: Untrusted JSON data and Schema objects are passed to the validator.validate() and validator.validateSchema() methods (SKILL.md).
Boundary markers: The instructions do not specify any boundary markers or sanitization requirements for the output of the validation process before it is consumed by the agent.
Capability inventory: The skill identifies capabilities for reading from the local filesystem (via the schema reader example) and making remote network requests to resolve schema references.
Sanitization: The provided examples for extending the validator (custom formats and schema readers) do not include sanitization logic for handling potentially malicious input strings.
[DATA_EXFILTRATION]: A documentation example in SKILL.md demonstrates a schema loader that uses the fs module to read local files based on a URI provided in the schema.
Evidence: The "Automatic loading via schema reader" section in SKILL.md shows fs.readFileSync(path.resolve(__dirname, 'schemas', uri + '.json'), 'utf8'). This code pattern is vulnerable to path traversal (LFI) if an attacker provides a URI like ../../secret within a $ref keyword in a malicious schema.

validating-json-data