The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill ingests merchant-controlled product catalog data which acts as untrusted content, creating a potential surface for indirect prompt injection.
Ingestion points: Untrusted content enters via catalog tools including search_products, get_product, and browse_store defined in references/tools.md.
Boundary markers: The skill correctly utilizes untrustedContentHint: true on all catalog reading tools to instruct the agent to treat the data as content rather than instructions.
Capability inventory: The agent has capabilities to mutate the shopping cart (add_to_cart, remove_from_cart), navigate the storefront, and open the checkout or login screens.
Sanitization: Security is enforced through clear tool descriptions that warn agents against asking for sensitive data (e.g., passwords or OTPs) and by requiring an explicit allowlist for external navigation via allowedExternalOrigins.

ce-ai