The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes and displays external listing data, including 'title' and 'description' fields, which are retrieved from a remote API. This configuration establishes a surface for indirect prompt injection if the source data contains malicious instructions designed to manipulate the agent's behavior.
Ingestion points: External data is ingested via the search_listings tool response and rendered in the final output.
Boundary markers: The skill instructions specify wrapping listing content within markdown blockquotes (>), which provides a visual boundary but does not programmatically isolate instructions.
Capability inventory: The skill possesses network communication capabilities through the specified MCP tool.
Sanitization: There are no explicit instructions to sanitize or filter the description or title fields for embedded prompt injection patterns before they are displayed to the user.
[EXTERNAL_DOWNLOADS]: The skill requires network access to external resources to function.
It specifies a backend API hosted on a raw IP address (101.42.15.203) rather than a verified domain name.
It retrieves image assets from the hpan.com.cn domain for listing covers.

huopan-listing-search