The Agent Skills Directory

[PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection. It instructs the agent to read the contents of untrusted files (PDFs, images, and screenshots) and extract information such as vendor names and descriptions. If an attacker-controlled invoice contains hidden instructions, the agent might execute them as part of its processing flow.
Ingestion points: The skill reads content from PDF, JPG, and PNG files located in user-specified directories (SKILL.md).
Boundary markers: The instructions lack explicit boundary markers or warnings to ignore embedded instructions within the extracted text.
Capability inventory: The skill utilizes file system operations including find, mkdir, cp, and mv commands (SKILL.md).
Sanitization: There is no evidence of sanitization, escaping, or validation of the text extracted from the invoices before it is used to determine organization paths or create filenames.
[COMMAND_EXECUTION]: The skill relies on executing shell commands to perform its core functions. It uses find to locate files and mkdir, cp, and mv to restructure the file system. While these are intended behaviors for an organization tool, they represent the capability set that could be abused if an indirect prompt injection attack occurs.

invoice-organizer