The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill's primary function is to fetch and process untrusted content from external websites (blogs, RSS feeds), which creates an attack surface for indirect prompt injection.
Ingestion points: External publication URLs, RSS feeds, and sitemaps fetched during the pagination and normalization phases.
Boundary markers: The skill defines specific instructions for isolating untrusted content using untrusted_directives: true in the YAML frontmatter and wrapping imperatives in untrusted-quoted fenced blocks.
Capability inventory: The agent uses network fetching tools and the put_page command to write data to the sources/ directory.
Sanitization: The skill mandates that the agent neutralize agent-directed imperatives at the ingest boundary by wrapping them in fences and forbids the agent from carrying them forward as tasks.
[PROMPT_INJECTION]: Static analysis identified phrases such as "ignore previous instructions" in SKILL.md. However, these are used descriptively within the "Untrusted content" section to define the types of malicious patterns the agent should look for and neutralize in external data. They are not attempts to override the agent's current instructions.

blog-ingest