The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted conversation history to generate structured summaries and evaluation probes, which could propagate malicious instructions into the agent's future context.
Ingestion points: The conversation_history is ingested in the ProbeGenerator class, and newly truncated content spans are processed by the StructuredSummarizer class in scripts/compression_evaluator.py.
Boundary markers: The generated summaries and probe outputs do not utilize delimiters (such as XML tags or triple backticks) or explicit 'ignore embedded instructions' warnings to isolate the extracted history from the agent's operational instructions.
Capability inventory: While the provided Python script does not possess dangerous capabilities like file writing, network access, or shell execution, its output is intended to drive the behavior of an agent that typically holds such privileges.
Sanitization: Information extracted via regular expressions (e.g., decisions, file modifications) is interpolated directly into markdown templates without validation or escaping, allowing attacker-controlled data from the history to influence the summary's narrative.

context-compression