The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill provides an example implementation for a 'CI/CD Code Review Agent' in references/deployment.md that is vulnerable to indirect prompt injection.
Ingestion points: The diff variable, representing untrusted external data from a pull request, is interpolated directly into the agent's prompt string.
Boundary markers: The prompt template lacks explicit delimiters (such as XML tags or unique markers) or specific instructions for the agent to ignore any embedded instructions within the diff.
Capability inventory: The agent in the example is granted access to the Read, Glob, and Grep tools, which provides a surface for file system exploration if the agent is manipulated by malicious content in the diff.
Sanitization: No sanitization, escaping, or filtering of the incoming diff content is performed before interpolation into the prompt.
[EXTERNAL_DOWNLOADS]: The skill references official SDK packages and tools from a well-known service provider for installation and execution.
Evidence: References to @anthropic-ai/claude-agent-sdk (NPM), claude-agent-sdk (PyPI), and the execution of @anthropic-ai/claude-code via npx in SKILL.md and references/deployment.md.
[DATA_EXFILTRATION]: The skill includes example code demonstrating how to send agent lifecycle data to an external network endpoint.
Evidence: A PreToolUse hook example in references/permissions-hooks-security.md uses fetch to send tool usage information to a placeholder domain (https://logs.example.com/webhook).

agent-sdk-builder