The Agent Skills Directory

[PROMPT_INJECTION] (HIGH): The skill is highly susceptible to indirect prompt injection attacks because it ingests untrusted external data and provides the agent with powerful tools.
Ingestion points: scripts/rss_helper.py fetches raw article content and RSS feed entries from arbitrary URLs provided in references/feeds.json or discovered during execution.
Boundary markers: Absent. The instructions do not define delimiters or provide system-level warnings to the agent to treat the fetched article text as data rather than instructions.
Capability inventory: The agent is granted Bash, Write, and Edit tools. This allows the agent to execute arbitrary shell commands or modify the local filesystem if it follows instructions embedded in a malicious article.
Sanitization: Absent. While the script strips HTML tags for readability, it does not sanitize the text for natural language instructions that could override the agent's behavior.
[COMMAND_EXECUTION] (LOW): The skill uses Bash to execute its helper script and perform file searches with grep. While these are functional requirements for the skill's workflow, they provide the execution environment that elevates the severity of the prompt injection vulnerability.

rss-catchup