The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: Several templates provided by the skill (such as code-reviewer, security-auditor, and data-analyst) instruct agents to process untrusted data (like code and datasets) while possessing powerful capabilities like shell command execution (Bash) and file editing (Edit). Other templates like support-assistant and legal-assistant utilize WebSearch to ingest external information. This combination creates an attack surface where malicious input data could potentially influence the agent's tool usage.
Ingestion points: The templates for the generated agents (e.g., templates/agents/code-reviewer.md, templates/agents/support-assistant.md) ingest data from user-supplied code files, documents, support tickets, and external websites via search tools.
Boundary markers: While templates include role definitions and "Forbidden" behavior lists, they do not prescribe specific delimiter systems or explicit instructions for the agent to disregard instructions embedded within the processed data.
Capability inventory: The templates authorize a range of tools including Bash, Write, Edit, WebSearch, Grep, Glob, and Read depending on the specific agent role.
Sanitization: There are no specific instructions in the templates regarding input sanitization or the validation of untrusted content before it is processed by the LLM.

prompt-library