The Agent Skills Directory

Indirect Prompt Injection Surface: The skill processes untrusted text data retrieved from external platforms, which creates an inherent exposure to indirect prompt injection if any external source contains instructions designed to alter the agent's execution flow.
Ingestion Points: External content enters the workspace via workflow steps 2 through 6 in SKILL.md, including data from PayPal disputes, HubSpot tickets, Gmail threads, Intercom conversations, and direct user-pasted reviews.
Boundary Markers: The instructions lack specific text delimiters or instruction isolation safety guidelines that explicitly direct the model to disregard formatting or commands embedded within the text data.
Capability Inventory: The overall potential exposure is minimized because the skill is restricted to a read-only execution environment. It lacks tools or instructions to write files, invoke system commands, modify records, or transmit data to external third-party servers.
Sanitization: The workflow includes no custom input sanitization or structural validation for the retrieved data, allowing external content to be processed directly as plain text.

customer-pulse