The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill inherently processes and stores untrusted user input from inbound messages into long-term storage pages, which could contain malicious instructions for later retrieval turns.
Ingestion points: Analyzes every substantive inbound message for original thinking and entities.
Boundary markers: The skill instructions emphasize capturing the user's "EXACT phrasing" without paraphrasing, which may preserve injection payloads exactly as delivered.
Capability inventory: The skill has permission to write to multiple directories (people/, companies/, concepts/, originals/, ideas/) using the put_page tool.
Sanitization: No explicit content sanitization is described before writing user-supplied text to the knowledge base.

signal-detector