The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest data from untrusted or externally influenced sources within the project environment, creating a potential surface for indirect prompt injection.
Ingestion Points: The skill reads asset schemas via inspect_project_asset (in references/author.md), retrieves existing flow definitions via retrieve_datastage_flow_code (in references/recover.md), and analyzes job run logs via get_job_run_logs (in references/diagnose.md).
Capabilities: The agent possesses high-privilege capabilities including flow creation and modification (create_pyflow, update_datastage_flow), job execution (create_job_run), and asset deletion (delete_asset).
Boundary Markers: While the skill implements a structured state machine to constrain agent behavior, it does not explicitly instruct the agent to use delimiters or ignore instructions that might be embedded in the data ingested from logs or schemas.
Sanitization: No explicit instructions for sanitizing or validating external content (e.g., column names, error messages) are provided before this content is used to build or modify data flows.
[PROMPT_INJECTION]: Specific instructions regarding communication style and autonomy were analyzed for potential action concealment.
Evidence: The skill instructs the agent in SKILL.md and references/author.md to avoid using internal jargon (e.g., "states", "backends", "pyflow") and to execute tasks autonomously without "interviewing" the user for details like schemas or column names.
Context: These instructions are determined to be benign user-experience and persona guidelines aimed at professional interaction. The skill maintains transparency by explicitly requiring the agent to "Say what you decided, and why" and to report all operational outcomes (successes and failures) to the user in the final summary.

di-agent-flow-lifecycle