The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is designed to handle untrusted user data via file uploads, which is a primary vector for indirect prompt injection. However, the provided implementations include robust security controls to mitigate this risk.
Ingestion points: File upload endpoints defined in references/fastapi-file-upload.md, references/pythonflask-file-upload.md, and references/nodejs-express-file-upload-with-multer.md accept binary and text data from users.
Boundary markers: The skill demonstrates the use of extension whitelists (ALLOWED_EXTENSIONS) and MIME type verification to restrict the type of content the system processes.
Capability inventory: The skill includes code for writing to the local file system (aiofiles, multer.diskStorage) and uploading to cloud storage (boto3).
Sanitization: The templates prioritize security by using randomized hashes for filenames to prevent directory traversal and overwriting existing files. The Flask example specifically utilizes secure_filename and safe_join to ensure file paths remain within the intended directory.
[EXTERNAL_DOWNLOADS]: The skill references standard, well-known libraries for file handling and web development. These include fastapi, aiofiles, and boto3 for Python, and multer for Node.js. All dependencies are standard industry tools for the described tasks.

file-upload-handling