The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection through several data ingestion points where it processes content from external sources that are not inherently trusted.
Ingestion points: The skill retrieves and analyzes untrusted data via get_job_run_logs (job logs), retrieve_datastage_flow_code (flow definitions), and read_data_preview (live database/file content).
Boundary markers: There are no specific instructions or delimiters provided to the agent to treat this ingested content as data rather than instructions, nor are there 'ignore embedded instructions' warnings.
Capability inventory: The skill possesses the ability to perform write operations, such as create_alert_definition and update_alert, and can perform external research using websearch and webfetch tools.
Sanitization: The instructions lack any requirement for the agent to sanitize, validate, or filter the external content before processing it for root-cause diagnosis.

di-agent-datastage-investigation