The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill documents tools that ingest untrusted data from agent context to perform sensitive operations without implementing or recommending sanitization.
Ingestion points: Multiple tools in SKILL.md and references/dependency_injection.md take raw strings directly from the LLM, including query_db(query: str, ...) and fetch(url: str, ...).
Capability inventory: The tools demonstrated have capabilities for database execution (db.execute), network requests (aiohttp, http.get), and file operations.
Sanitization: The provided examples lack sanitization or parameterization. For instance, db.execute(query) in references/dependency_injection.md directly executes a string that could contain malicious SQL injection payloads embedded in the agent's prompt.
Boundary markers: No explicit instructions or markers are provided to the agent to ignore instructions embedded within the data processed by these tools.
Remediation: Users should be advised to use parameterized queries (e.g., db.execute("SELECT * FROM table WHERE id = ?", (id,))‐) and validate URLs against a whitelist before performing network operations.

ag2-add-custom-tool