The Agent Skills Directory

Indirect Prompt Injection Surface: The skill processes external data from security incidents, such as case titles, descriptions, and alert names, which could potentially contain malicious directives. The skill mitigates this by including a 'Prompt Injection Defense Directive' that instructs the agent to treat these fields as untrusted data rather than instructions.
Ingestion points: Untrusted data enters via tool outputs from list_cases, get_case, and list_case_alerts (documented in SKILL.md).
Boundary markers: The skill provides a specific directive warning the agent to ignore embedded instructions (present in SKILL.md).
Capability inventory: The skill possesses write capabilities including update_case, create_case_comment, and execute_bulk_close_case (documented in SKILL.md).
Sanitization: The skill relies on natural language instructions for the agent to treat data as untrusted rather than programmatic filtering.
Security Guardrails: The instructions include explicit constraints that prevent the agent from performing high-risk actions. It forbids reading sensitive paths like ~/.ssh or service account keys, prevents the creation of new credentials using gcloud, and prohibits IAM role modifications. These boundaries support a least-privilege operational model.
Execution Environment Constraints: The skill mandates the use of registered Model Context Protocol (MCP) tools and strictly forbids constructing raw HTTP or JSON-RPC calls. This ensures that all operations occur through sanctioned, authenticated interfaces rather than direct network manipulation.

secops-cases