The Agent Skills Directory

[PROMPT_INJECTION]: The skill ingests untrusted XML data which presents a surface for indirect prompt injection.
Ingestion points: Methods parse_file and parse_string in SKILL.md allow external XML content to enter the agent context.
Boundary markers: No delimiters or isolation instructions are present to prevent the agent from executing instructions found within the XML fields.
Capability inventory: The skill is granted filesystem permissions and uses pandas for data structuring, allowing it to read and process local files.
Sanitization: The implementation uses the standard xml.etree.ElementTree library, which is vulnerable to XXE and Billion Laughs attacks; no sanitization or safer alternatives like defusedxml are employed.

xml-reader