The Agent Skills Directory

[PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection because it retrieves and processes user-generated content (highlights, book titles, and notes) from the Readwise API. This content could contain malicious instructions designed to hijack the agent's behavior during tasks like summarization.
Ingestion points: Content is ingested via the highlights list, highlights review, and book commands in scripts/readwise_client.py.
Boundary markers: The skill does not implement delimiters or explicit instructions to ignore commands within the fetched data.
Capability inventory: The skill uses Bash(uv run *) and can read local files via CLI parameters.
Sanitization: No sanitization or validation of the API-provided strings is performed before they are presented to the agent.
[COMMAND_EXECUTION]: The scripts/readwise_client.py script allows the agent to read local files using the --text-file and --bulk-file options.
This functionality enables the agent to access arbitrary files on the system. Although the data is intended for transmission to a well-known service (Readwise), it represents a potential data exposure risk if the agent is manipulated into reading sensitive system files.
[PROMPT_INJECTION]: The SKILL.md instructions include override-style markers such as 'Critical' and 'Always specify', although these are used for legitimate operational guidance regarding API usage rather than malicious bypasses.

readwise