The Agent Skills Directory

[PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection because it is designed to ingest and process untrusted content from external URLs and local files.
Ingestion points: The source_materials parameter in SKILL.md accepts direct text, file paths, and URLs.
Boundary markers: There are no explicit instructions or delimiters defined to prevent the model from obeying instructions embedded within the source materials.
Capability inventory: The skill possesses file-read and file-write capabilities via the source_materials and output_location parameters, as well as network-read capabilities via URLs.
Sanitization: The workflow lacks sanitization or validation steps to filter potential malicious instructions from the input data.
[DATA_EXFILTRATION]: The skill's ability to read from local file paths and write to a user-specified output_location could be misused to expose sensitive information.
Evidence: The output_location parameter in SKILL.md allows the agent to write the results of its synthesis to any accessible path on the filesystem.
Evidence: The source_materials parameter allows the agent to read contents from arbitrary file paths, which could include sensitive configuration or credential files if provided by an attacker.
[EXTERNAL_DOWNLOADS]: The skill fetches content from remote URLs, which constitutes a network operation to non-whitelisted domains.
Evidence: The source_materials parameter documentation explicitly supports URLs as a source of information for the synthesis workflow.

validated-knowledge-synthesis