The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest webhook payloads from Grafana, which introduces external, untrusted data into the agent's environment.
Ingestion points: The POST /webhooks/grafana endpoints in the Next.js, Express, and FastAPI example applications.
Boundary markers: The skill provides robust boundaries by requiring HMAC-SHA256 signature verification and implementing a configurable replay window to ensure data authenticity.
Capability inventory: The provided code is limited to logging and internal state dispatching (e.g., firing vs. resolved alerts); it does not perform high-risk operations such as file system writing or command execution based on the payload.
Sanitization: All example implementations verify the raw request body against the shared secret before attempting to parse the JSON content.
[UNVERIFIABLE_DEPENDENCIES]: Several dependency files in the example directories list version numbers that do not currently exist in public registries.
Evidence: examples/nextjs/package.json specifies typescript@^7.0.2 and next@^16.3.6. examples/fastapi/requirements.txt specifies fastapi>=0.141.1.
Context: The package names are legitimate and belong to well-known organizations. While the versions are non-standard, they do not appear to point to malicious sources but may indicate synthetic or future-dated template generation.

grafana-webhooks