The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill creates a surface for indirect prompt injection by allowing the agent to ingest external data from a chat system.
Ingestion points: The read-messages tool in SKILL.md allows the agent to retrieve message content from external chat channels.
Boundary markers: The instructions do not specify the use of delimiters or provide the agent with guidance on how to distinguish between trusted instructions and untrusted data within the chat messages.
Capability inventory: The skill is limited to messaging operations (list-channels, create-channel, post-message, read-messages). It does not include tools for file system access, shell command execution, or other high-privileged actions.
Sanitization: There are no instructions or mechanisms provided for sanitizing or validating the content retrieved from the messaging server before the agent processes it.

swarm-chat