The Agent Skills Directory

[PROMPT_INJECTION]: The skill exhibits an attack surface for indirect prompt injection due to its core function of processing untrusted data.
Ingestion points: The skill instructions in SKILL.md explicitly direct the agent to accept and ingest "transcripts, interviews, pasted content, files, and URLs as input."
Boundary markers: There are no instructions provided to wrap external content in delimiters (e.g., triple backticks) or to treat embedded instructions as data only.
Capability inventory: The skill includes a file-writing capability, specifically writing analysis results to the docs/service-design/ directory.
Sanitization: The instructions lack any requirement for the agent to sanitize, escape, or validate the content of the external sources before processing them.
[DATA_EXFILTRATION]: The skill performs network operations by fetching content from user-provided URLs. While no explicit exfiltration patterns were found, the ability to read arbitrary URLs combined with the instruction to "ingest them, don't summarize them" could be leveraged if an attacker provides a URL containing malicious payloads or instructions.

empathy-analysis