The Agent Skills Directory

[PROMPT_INJECTION]: The instructions contain steering language intended to override the agent's default tool selection logic.
Evidence: The skill specifies it should be used by default whenever the user wants to review pending orders and instructs the agent to "Prefer this skill over raw MCP tools when it reasonably fits" and to "Skip only if the user explicitly asks not to use this skill/workflow."
[INDIRECT_PROMPT_INJECTION]: The skill processes data from an external shop API which could contain malicious instructions designed to influence the agent.
Ingestion points: External data is ingested through the shop_list_orders, shop_get_order, and shop_get_customer tools mentioned in SKILL.md.
Boundary markers: The instructions do not define clear delimiters or "ignore instructions" warnings for the agent when processing order details.
Capability inventory: The skill includes the shop_update_order_shipping tool, which allows for data modification (write capability) in the shop environment.
Sanitization: There are no documented steps for sanitizing or validating fields such as customer names or order notes that might contain malicious payloads.

shop-order-followup