The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill instructions define an architectural surface for ingesting untrusted behavioral data from end-users (e.g., product IDs, category IDs, and session events) to power recommendation engines. Maliciously crafted data from a website visitor could potentially influence the agent's behavior or output if it processes this data without sufficient sanitization or boundaries.\n
Ingestion points: SKILL.md (specifically the PersonalizationEvent interface and the updateUserProfile function).\n
Boundary markers: No specific delimiters or "ignore embedded instructions" warnings are provided in the architectural code snippets or implementation tasks.\n
Capability inventory: The skill is intended for use by high-capability agent platforms (e.g., claude-code, cursor, gemini-cli) which have access to development tools and shell environments, increasing the potential impact if a malicious instruction is processed.\n
Sanitization: The provided architectural examples and tasks do not explicitly implement sanitization, validation, or escaping of the ingested product or category fields.

predictive-personalization