The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill provides instructions for agents to ingest data from untrusted external sources, creating an attack surface for malicious instructions embedded in that data.
Ingestion points include email handling (references/email.md), webhook processing (references/webhooks-push.md), and web scraping via browser tools (references/browse-the-web.md).
Agents possess significant capabilities such as direct SQLite access, tool execution, and durable workflow management, which could be misused if an injection is successful.
Mandatory Evidence Chain:
Ingestion points: onEmail (references/email.md), onRequest for webhooks (references/webhooks-push.md), browser_search/browser_execute (references/browse-the-web.md).
Boundary markers: The documentation shows interpolation using convertToModelMessages (references/streaming-chat.md) but does not detail explicit delimiters for raw external data.
Capability inventory: SQL query execution (this.sql), durable fibers (runFiber), workflow management (runWorkflow), and network requests (fetch).
Sanitization: Signature verification is documented for webhooks, but general input sanitization for scraped content or email bodies is not explicitly covered in the generic examples.
[DYNAMIC_EXECUTION]: The skill documents features that allow for the runtime execution of code generated or orchestrated by the AI model.
The 'Codemode' feature (references/codemode.md) uses a DynamicWorkerExecutor to run JavaScript in an isolated sandbox to handle complex tool chaining logic.
The Browser tools (references/browse-the-web.md) allow the LLM to write and execute asynchronous JavaScript IIFEs within a browser session for scraping and interaction.
These are documented, intended capabilities of the SDK designed for advanced tool orchestration and automation tasks.

agents-sdk