The Agent Skills Directory

[PROMPT_INJECTION]: The skill contains a comprehensive catalog of prompt injection patterns and jailbreak techniques in references/threat-catalog.md and references/attack-cases.md. These are passive references designed to assist the agent in identifying similar threats in external content and are not directed at the host agent itself.\n- [DATA_EXFILTRATION]: Examples of exfiltration commands (e.g., curl to external IP addresses) are present in references/attack-cases.md and references/self-test.md. These use standard documentation/test IP ranges (RFC 5737) and serve as detection benchmarks rather than operational instructions.\n- [OBFUSCATION]: The skill includes various obfuscation samples, such as Base64-encoded strings, hex encoding, and BiDi text (in references/attack-cases.md and references/self-test.md), to train the agent on how to recognize and decode malicious payloads. These are correctly identified as threats within the skill's own scanning protocol.\n- [INDIRECT_PROMPT_INJECTION]: The skill's primary function is to process untrusted external data using a library of malicious patterns, which introduces a theoretical surface for indirect injection. However, the implementation is evaluated as safe due to robust mitigations:\n
Ingestion points: Untrusted data enters the context via the scan and self-test commands in SKILL.md.\n
Boundary markers: SKILL.md defines authoritative Red Lines that explicitly command the agent to treat scanned content as data only and never to execute instructions found within references.\n
Capability inventory: The skill's YAML frontmatter in SKILL.md denies access to sensitive tools (file-write: false, network: false, shell: false), adhering to the principle of least privilege.\n
Sanitization: The skill employs a multi-layered normalization protocol to strip obfuscation and a semantic analysis layer to detect malicious intent independently of specific phrasing.

security-scan