The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill and its associated evaluation tasks establish a workflow for ingesting customer data (such as names and purchase history) and interpolating it into communication templates, creating a vector for indirect prompt injection.
Ingestion points: The skill instructions and task specifications in evals/lapsed-customer-segmentation-logic/task.md and evals/win-back-sequence-and-offer-personalizat/task.md describe querying customer databases (db.customers.findAll) and processing Order and Customer objects.
Boundary markers: There is no instruction to use delimiters or guardrail prompts to prevent the agent from obeying instructions that might be embedded within the customer-controlled data fields.
Capability inventory: The system is designed to perform several sensitive actions based on this data, including sending emails (sendEmail) and scheduling automated jobs via winBackQueue as specified in the evals/ tasks.
Sanitization: The documentation and task descriptions lack requirements for the sanitization or validation of untrusted input strings before they are used in automated workflows or presented to the agent.

win-back-reactivation