The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill establishes an attack surface for indirect prompt injection by defining how to ingest and process untrusted data from external network APIs.
Ingestion points: Data enters the agent's context through client.get, client.post, and client.body() calls within the UserApi class and safeRequest function in SKILL.md.
Boundary markers: No natural language boundary markers or instructions to ignore embedded commands are present in the provided templates.
Capability inventory: The skill utilizes network communication (HTTP GET/POST/PUT/DELETE) and uses the OkHttp engine for request execution.
Sanitization: The skill employs kotlinx.serialization (DTO mapping) to ensure type safety, which serves as a basic form of data validation by enforcing a fixed schema on incoming JSON payloads.
[SAFE]: The skill uses established, standard libraries (io.ktor) for all networking tasks.
[SAFE]: The implementation of security features such as Certificate Pinning and Bearer token authentication follows industry-standard security protocols for Android networking.
[SAFE]: Logging is correctly configured to only output network body details during debug builds (BuildConfig.DEBUG), preventing sensitive data leakage in production environments.

ktor-patterns