The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill documents the context.input() mechanism, which creates an ingestion point for untrusted user data to enter the tool execution flow. While this is the intended purpose of the skill, it represents a potential surface for indirect prompt injection if the user-provided data is not properly validated by the tool receiving it.
Ingestion points: context.input() calls within tool bodies (e.g., in the execute_query example in SKILL.md).
Boundary markers: The provided examples show basic logic checks (e.g., if answer.strip().lower() != "yes") but do not demonstrate the use of delimiters or explicit boundary instructions for the gathered input.
Capability inventory: The skill demonstrates these patterns being used with high-privilege tool types such as database query execution, account deletion, and email transmission.
Sanitization: No sanitization or escaping of the input content is demonstrated before it is used by the tool logic.
[SAFE]: The documented patterns are intended as security controls to provide human oversight (Human-in-the-loop) for sensitive, irreversible, or expensive operations.
[SAFE]: The skill promotes security best practices by instructing developers to collect sensitive information like passwords and API keys from users at runtime rather than hardcoding them into the skill or configuration files.
[SAFE]: Includes guidance on common implementation pitfalls, such as the necessity of timeouts for confirmation prompts and proper handling of denial paths.

ag2-hitl