The Agent Skills Directory

[PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection because it is designed to ingest and process untrusted external data in the form of source code and notebooks.
Ingestion points: The skill utilizes the Read tool to access external code files for analysis.
Boundary markers: No explicit delimiters or instructions are provided to the agent to treat comments or strings within the ingested code as data rather than instructions, which could allow an attacker to influence the agent's behavior.
Capability inventory: The skill is granted Read and Edit permissions, enabling it to modify files based on its analysis of untrusted content.
Sanitization: There is no evidence of sanitization or validation of the ingested content before it is processed by the agent.

copilot