The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes various forms of untrusted external data which could contain malicious instructions intended to manipulate the agent's behavior.
Ingestion points: Tools such as query_worker_observability fetch logs and metrics, get_url_html_content and get_url_markdown retrieve web content, and workers_get_worker_code reads source code. Additionally, scenarios.md describes cloning external repositories using git clone within a container sandbox.
Boundary markers: The skill defines a "Three-step Flow" for write operations in SKILL.md which acts as a manual approval gate, but it does not provide explicit prompt delimiters or instructions for the agent to ignore potentially malicious content embedded in the ingested data.
Capability inventory: The skill has access to powerful capabilities including Bash (shell execution), WebFetch (network requests), d1_database_query (SQL execution), and container_exec (arbitrary command execution in a sandbox).
Sanitization: There is no evidence of technical sanitization or filtering applied to external content before it is processed by the agent.
[DYNAMIC_EXECUTION]: The skill facilitates the creation and execution of scripts at runtime within its "Super Admin Tier".
Evidence: SETUP.md defines tools for a container sandbox, including container_file_write and container_exec.
Evidence: scenarios.md (Scenario 19) illustrates the agent generating a Python script (analyze.py) and executing it to perform data analysis.
[COMMAND_EXECUTION]: The skill provides interfaces for executing arbitrary shell commands, primarily for troubleshooting and resource management.
Evidence: The skill's instructions in BACKENDS.md frequently use the Bash tool to run Wrangler CLI commands.
Evidence: The container_exec tool in the Super Admin tier allows for running arbitrary commands like npm test or git clone as shown in scenarios.md.

cloudflare