The Agent Skills Directory

Indirect Prompt Injection (LOW): The skill ingests untrusted data through app searches and source code submissions, creating a surface for indirect instructions to influence agent behavior.
Ingestion points: Untrusted data enters the context via mcp__flow-nexus__app_search results and the source_code parameter in the mcp__flow-nexus__app_store_publish_app tool.
Boundary markers: Absent. There are no specific delimiters or instructions defined to prevent the agent from following instructions embedded within the application descriptions or source code being processed.
Capability inventory: The agent has the ability to deploy templates (mcp__flow-nexus__template_deploy), publish apps, and manage analytics. A malicious app description could potentially trick the agent into misconfiguring a deployment.
Sanitization: No sanitization or validation logic is explicitly defined within the skill instructions for handling the ingested marketplace data.
Data Exposure (SAFE): The template_deploy tool accepts sensitive variables such as api_key and database_url. While this is an intended function for deployment, it involves the agent handling credentials. No hardcoded secrets or unauthorized data access patterns were found.

agent-app-store