The Agent Skills Directory

[PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection by allowing the persistence of natural language instructions in scheduled tasks.\n
Ingestion points: The --message argument in the create and update commands, and the message fields within JSON files processed by batch-create in scripts/cron_manager.py.\n
Boundary markers: Absent. Stored messages are later fed to the agent as instructions without delimiters or protective framing to distinguish them from system instructions.\n
Capability inventory: The skill enables the creation and modification of persistent scheduled tasks that dictate future agent behavior.\n
Sanitization: No sanitization or validation is applied to the content of the messages.\n- [COMMAND_EXECUTION]: The skill uses a Python script to perform its operations, which is executed via the system shell.\n
Evidence: Implementation in scripts/cron_manager.py is invoked using python3 as defined in SKILL.md.\n- [DATA_EXFILTRATION]: The batch creation feature allows reading arbitrary local files, creating a risk of data exposure.\n
Evidence: The cmd_batch_create function in scripts/cron_manager.py opens a user-provided file path. If an attacker directs this to a sensitive file, the resulting JSON parsing error could leak parts of the file's content to the agent's output.

cron-manager