The Agent Skills Directory

[PROMPT_INJECTION]: Behavioral Instruction Steering. The SAFETY.md and SKILL.md files contain a high volume of instructional text disguised as a 'Safety Evaluation'. These sections instruct the agent to adopt specific refusal patterns and logic (e.g., rejecting requests that use 'CTO approval' or 'Team Lead' framing), which overrides the agent's default reasoning and safety protocols with skill-specific constraints.
[PROMPT_INJECTION]: Indirect Prompt Injection Surface. The skill ingests untrusted data from the internet via the Google Custom Search API.
Ingestion points: The scripts/search.py script returns raw JSON search results (snippets, titles) from the web to the agent context.
Boundary markers: Absent. There are no delimiters or 'ignore embedded instructions' warnings provided around the data returned from the search script.
Capability inventory: The skill includes instructions for the agent to perform file system operations, specifically creating and modifying .env and .gitignore files.
Sanitization: The skill does not perform any sanitization or filtering of the search results before they are processed by the agent, allowing potential instructions embedded in web content to influence agent behavior.
[PROMPT_INJECTION]: Autonomy Escalation. The instructions in SKILL.md explicitly direct the agent to 'proceed without additional confirmation gates' when creating .env files if a .gitignore check passes. This encourages the agent to bypass human-in-the-loop verification for file system modifications.

google-search-hardened