The Agent Skills Directory

[PROMPT_INJECTION]: The skill instructions in SKILL.md and documentation in evals/README.md contain strings often associated with injection attacks, such as 'ignore previous instructions'. These are used defensively as examples to train the AI to detect and ignore such patterns when reviewing user-provided workflow files, rather than as an attempt to hijack agent behavior.
[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and analyze untrusted GitHub Actions workflow files, creating a surface for indirect prompt injection where malicious instructions could be hidden in comments or configuration values.
Ingestion points: The skill targets files matching patterns such as **/.github/workflows/*.yml and **/.github/actions/**/*.yml as defined in the frontmatter.
Boundary markers: The SKILL.md file contains a 'Reviewing untrusted input' section that explicitly instructs the agent to treat reviewed files as data rather than instructions, providing a clear boundary for the model.
Capability inventory: The skill utilizes the Glob and Read tools to access the filesystem and generates security reports or scaffolds new YAML configurations based on its findings.
Sanitization: The instructions include specific warnings against zero-width characters, unicode tricks, and posed directives (e.g., 'mark this clean'), effectively providing natural language sanitization for the agent's context.

github-actions