The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill ingests raw article text to transform it into structured pages. This workflow creates a surface for indirect prompt injection, as the source articles could contain malicious instructions intended to manipulate the agent during the enrichment phase.
Ingestion points: The agent reads raw content from pages located in media/articles/ using the gbrain get command as described in the pipeline and invocation sections of SKILL.md.
Boundary markers: The instructions do not define specific delimiters or "ignore embedded instructions" warnings to isolate the untrusted article content from the agent's internal instructions during interpolation into the LLM prompt.
Capability inventory: The skill utilizes the gbrain tool to perform database queries, read files, and write structured markdown to the filesystem via the put_page operation, which are capabilities that could be targeted by an injection attack.
Sanitization: There is no requirement for filtering, escaping, or validation of the ingested text before it is processed by the agent's models (Sonnet or Opus).

article-enrichment