The Agent Skills Directory

[PROMPT_INJECTION]: The server implementation provides an indirect injection surface by logging unsanitized request metadata from network headers.
Ingestion points: The GetUser method in SKILL.md extracts the x-forwarded-for header from gRPC metadata using metadata.FromIncomingContext(ctx).
Boundary markers: Absent; the extracted header value is interpolated directly into a format string for logging.
Capability inventory: The code uses log.Printf to write to standard output, which may be monitored by the agent or external logging systems.
Sanitization: Absent; the input is not validated, escaped, or filtered before being logged.

grpc