The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted external data from Halo tickets and knowledge base articles, which represents a potential attack surface for indirect prompt injection.
- Ingestion points: External data enters the agent's context through tools such as halo_get_ticket, halo_get_ticket_actions, halo_list_tickets, and halo_get_kb_article as described in SKILL.md.
- Boundary markers: The instructions do not define any delimiters or provide guidance to the agent to ignore or isolate instructions potentially embedded within ticket notes or KB bodies.
- Capability inventory: While the tools described are read-only, the skill references integration with halo-change-request for performing writes and executes a local server script mcp-servers/halo-mcp/halo_mcp_server.py (SKILL.md).
- Sanitization: There are no explicit instructions for filtering, escaping, or validating external content before it is processed by the AI agent.
[COMMAND_EXECUTION]: The skill facilitates the execution of a local Python script to manage tool interactions.
- Evidence: The skill definition specifies running python3 -u mcp-servers/halo-mcp/halo_mcp_server.py to start the MCP server instance (SKILL.md).

halo-ticket-context