The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill aggregates potentially untrusted data from the chat environment, including messages from other participants, reports from subagents, and external project metadata such as pull request descriptions and CI logs.\n
Ingestion points: The logic in SKILL.md directs the agent to collect chat history, subagent reports, and project-related metadata from the current session.\n
Boundary markers: The instructions do not define specific structural delimiters or encapsulation techniques (such as XML tags) to isolate untrusted data from the agent's instructions.\n
Capability inventory: The skill utilizes tools for UI automation and visualization, including preview_snapshot, preview_recording_start, preview_recording_stop, and html_render.\n
Sanitization: The skill incorporates a strong 'read-only' constraint, explicitly forbidding code changes or the starting of new jobs, which significantly limits the risk of malicious instructions within the input data triggering unintended actions.

ketchup