The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted blog content from files or directories to extract tags and categories. If an attacker embeds malicious instructions in headings, bold text, or metadata of a blog post, the agent could potentially follow them during the 'suggest' or 'audit' workflows.
Ingestion points: Reads files and directories via /blog taxonomy suggest <file> and /blog taxonomy audit [directory].
Boundary markers: None explicitly defined for the content analysis phase.
Capability inventory: Performs authenticated network requests (POST/GET) to various CMS platforms (WordPress, Shopify, Ghost, Strapi, Sanity) to create or update tags, categories, and posts.
Sanitization: No specific sanitization or filtering of the extracted text before processing is described.
[COMMAND_EXECUTION]: The skill instructions describe executing various API calls (REST and GraphQL) using authenticated credentials. While these are part of the intended functionality, they represent a high-privilege surface if the agent is misdirected.
[DATA_EXFILTRATION]: While the skill primarily syncs taxonomy data to the user's configured CMS, it reads environment variables (CMS_API_KEY, CMS_USERNAME) and sends them to the configured CMS_URL. A malicious CMS_URL provided by a user or an attacker could lead to credential exfiltration, though the skill instructions do include security rules for DNS resolution and private IP blocking.

blog-taxonomy