The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and analyze potentially untrusted data from various sources, creating a surface for indirect prompt injection where malicious instructions could be embedded in the analyzed content.
Ingestion points: The skill processes web pages, tickets, logs, documents, messages, tool results, and retrieved memory as part of its security review workflow, as specified in SKILL.md and the references/agentic-threat-model.md.
Boundary markers: The instructions include explicit boundary markers, stating that external data should be treated only as data and never as a source of authority. This is emphasized in both SKILL.md and references/safety.md.
Capability inventory: The agent has the capability to read repository files, execute local read-only commands for system diagnosis, and potentially modify local code or configuration if tasked with fixing a finding, as detailed in SKILL.md.
Sanitization: The references/agentic-threat-model.md file notes a requirement to sanitize structure and prevent authority promotion when handling untrusted propagation, although the specific sanitization methods are not defined.

krt-security-sentinel