The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from external web searches and local repository files to generate explanations. This creates a surface for indirect prompt injection where malicious instructions embedded in the data could attempt to influence the agent's behavior.
Ingestion points: WebSearch tool results for version-specific topics, and Read/Grep tool outputs when explaining code in the current repository (referenced in SKILL.md Step 2).
Boundary markers: The skill explicitly references references/untrusted-content-rule.md in Step 2, instructing the agent to treat external content as data and not as instructions.
Capability inventory: The skill uses WebSearch, Read, Grep, and Artifact tools. Malicious content could potentially attempt to abuse these tools if the agent ignores the provided guardrails.
Sanitization: The untrusted-content-rule.md provides guidance on extracting values without obeying commands and specifically warns against acting on instructions found in untrusted text.
[EXTERNAL_DOWNLOADS]: The skill uses the WebSearch tool to retrieve information on recent or contested topics. This is a standard part of the skill's functionality for information gathering.
[COMMAND_EXECUTION]: The skill uses Read and Grep tools to inspect files in the current repository. This is used solely for the intended purpose of explaining local code to the user.

explain-simply