The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill exhibits an attack surface for indirect prompt injection through its log analysis and configuration authoring capabilities.
Ingestion points: The agent ingests untrusted data from Dispatcher logs via the tail_logs tool and request details via trace_request (documented in incident-response/SKILL.md and config-authoring/SKILL.md).
Boundary markers: Absent. The instructions do not define clear delimiters or markers to separate untrusted tool output from the agent's internal reasoning, nor do they include warnings to ignore instructions found within external data.
Capability inventory: The agent has the capability to create and modify critical system configuration files, such as .any, .vhost, and .rules files (documented in config-authoring/SKILL.md).
Sanitization: Absent. There are no explicit instructions for the agent to filter, escape, or sanitize content retrieved from logs before processing it.

dispatcher