The Agent Skills Directory

[Indirect Prompt Injection] (HIGH): The skill processes untrusted data from an external source (Breeze) and possesses high-privilege capabilities.
Ingestion points: Data returned from Breeze via RUBE_MULTI_EXECUTE_TOOL and RUBE_SEARCH_TOOLS (as documented in SKILL.md).
Boundary markers: Absent. There are no instructions to the agent to delimit or ignore instructions embedded within retrieved Breeze data.
Capability inventory: RUBE_MULTI_EXECUTE_TOOL (write/modify data) and RUBE_REMOTE_WORKBENCH (arbitrary tool execution) in SKILL.md.
Sanitization: Absent. No validation or filtering of content retrieved from the external toolkit is mentioned.
[External Downloads] (MEDIUM): The setup instructions require the user to add an external third-party MCP server (https://rube.app/mcp). This source is not within the defined [TRUST-SCOPE-RULE] list, meaning the execution logic is entirely controlled by an unverified remote provider.
[Remote Code Execution] (MEDIUM): The RUBE_REMOTE_WORKBENCH and RUBE_MULTI_EXECUTE_TOOL patterns allow the agent to execute operations on remote infrastructure. While intended for Breeze automation, the lack of local control over the tool logic presents a risk of arbitrary execution if the remote provider is compromised or malicious.

breeze-automation