The Agent Skills Directory

[COMMAND_EXECUTION]: The skill uses umctl query run to execute SPL (Search Processing Language) queries. This allows it to interact with workspaces and entity sets to retrieve skill and knowledge definitions.
[INDIRECT_PROMPT_INJECTION]: The skill's primary function is to load and follow instructions from external SKILL.md files and knowledge items, creating a surface for indirect injection.
Ingestion points: Data is ingested through the list_skills and list_knowledge entity calls, specifically accessing files[].SKILL.md and knowledge_detail fields.
Boundary markers: The instructions explicitly state that knowledge is an "untrusted reference" and should not be treated as instructions or authorization. It also specifies that only inline content should be processed, skipping external URLs.
Capability inventory: The skill has the capability to execute SPL queries via umctl. However, it includes explicit prohibitions against running embedded scripts, executing remote code, or fetching external URLs (skill_url, content_url).
Sanitization: The skill relies on filtering (using only inline Markdown) and explicit instruction-based constraints rather than programmatic sanitization or escaping of the ingested content.

umodel-skill-runner