The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill exhibits an indirect prompt injection attack surface because it retrieves and processes external LLM trace data, spans, and dataset records which may contain arbitrary user-generated inputs.
Ingestion points: Trace logs, annotations, and evaluations are imported into the runtime environment via ax spans export and ax datasets export commands in SKILL.md.
Boundary markers: Present. The optimization meta-prompt template in SKILL.md wraps untrusted payload variables within explicit boundaries like ORIGINAL BASELINE PROMPT and PERFORMANCE DATA using markdown headers and delimiter lines.
Capability inventory: The skill executes local administrative actions using the ax CLI tool and processes JSON payloads using jq commands across SKILL.md, references/ax-profiles.md, and references/ax-setup.md.
Sanitization: Absent. The workflow relies entirely on structural delimiters and prompt engineering constraints rather than programmatically sanitizing text within the variables.

arize-prompt-optimization