The Agent Skills Directory

[Prompt Injection] (MEDIUM): Indirect prompt injection risk through untrusted project metadata. • Ingestion points: The detect_project_info function in project_detector.py reads data from package.json, pyproject.toml, go.mod, Cargo.toml, composer.json, and Gemfile. • Boundary markers: None. Extracted strings are directly replaced in templates using customize_template in template_customizer.py. • Capability inventory: The skill produces documentation templates intended for agent context. Malicious strings in configuration files (e.g., a project name containing 'Ignore previous instructions') can manipulate the agent's logic. • Sanitization: No sanitization or character filtering is performed on the extracted metadata before interpolation.
[Data Exposure] (LOW): Potential for local file existence probing. The detect_project_info function accepts a cwd parameter; if an agent allows user-supplied paths, it could be used to verify the presence of specific configuration files across the filesystem.

nav-init