The Agent Skills Directory

[PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection because it processes untrusted project configuration files.
Ingestion points: The logic defined in SKILL.md reads and parses package.json, pyproject.toml, Cargo.toml, and go.mod to identify project metadata.
Boundary markers: There are no explicit delimiters or instructions provided to the agent to treat the content of these files as untrusted or to ignore any embedded commands.
Capability inventory: The skill utilizes Read and Bash (grep and ripgrep) capabilities to extract information from the filesystem.
Sanitization: The implementation examples show that values from the configuration files (such as descriptions or dependency names) are extracted and stored without sanitization or validation, which could be exploited if an attacker places malicious instructions in these fields.

moai-alfred-language-detection