The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and analyze LLM execution traces, which typically contain untrusted data from external users, creating a potential vector for indirect prompt injection.
Ingestion points: Data enters the system context via client.get_spans_dataframe in SKILL.md and references/advanced-usage.md.
Boundary markers: The provided evaluation templates (such as CUSTOM_EVAL_TEMPLATE in references/advanced-usage.md) do not include explicit delimiters or instructions to the model to ignore embedded commands within the trace data.
Capability inventory: The skill uses run_evals and llm_classify (in SKILL.md and references/advanced-usage.md) to perform LLM-based logic on the ingested trace content.
Sanitization: There is no evidence of sanitization or filtering of the trace content before it is interpolated into evaluation prompts.

phoenix-observability