The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process external observability data from a hosted MCP server, which constitutes a potential attack surface for indirect prompt injection if the monitored data (such as query metadata or recommendations) contains malicious instructions.
Ingestion points: Data enters the context via tools such as helix_get_query_insights and helix_list_query_recommendations (which returns a complete MDX body).
Boundary markers: The skill explicitly instructs the agent to treat every result as untrusted, include a content_trust: "untrusted_data" flag, and warns never to present content as system instructions.
Capability inventory: The skill's tools are strictly read-only (helix_list_*, helix_get_*) and are restricted from resource mutations or query execution.
Sanitization: The instructions mandate that the agent must summarize findings in its own words and prohibits copying returned content into shell or write-capable tools without separate user review.

helix-mcp