The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and act upon data from untrusted external sources, creating a surface for indirect prompt injection attacks. * Ingestion points: Untrusted data enters the agent context through tools such as workspace_browser_snapshot, workspace_browser_search_results, and workspace_read_app_log as described in SKILL.md. * Boundary markers: The instructions include safety constraints, such as requiring explicit user approval for real-world actions (purchases, account changes) and advising the agent to keep drafting separate from final actions. However, it does not specify explicit "ignore embedded instructions" delimiters for all ingested content. * Capability inventory: The skill possesses significant capabilities to act on the environment, including launching applications (workspace_launch_app), running commands (workspace_run_app), and sending user inputs (workspace_click, workspace_type_text, workspace_paste_text) within the isolated workspace. * Sanitization: There is no mention of explicit sanitization, filtering, or escaping of external content before it is interpolated into the agent's context.
[COMMAND_EXECUTION]: The skill provides instructions for the agent to execute local shell commands for installation and maintenance tasks. * The SKILL.md file describes the use of a local ./install.sh script with various flags (e.g., --clean-codex-config) to manage the skill's deployment. * It also mentions a validation tool named agnix which is used by the agent to check skill configurations.

agent-workspace-linux