The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill functions as a durable orchestration loop that ingests external and model-generated data, creating a potential vector for indirect prompt injection where instructions hidden in data could influence agent behavior.
Ingestion points: Untrusted data enters the agent's context via the harness::send function payload, reactive trigger event data, and metadata provided to harness::react for spawning sub-agents (SKILL.md).
Boundary markers: The framework uses a deny-by-default tool dispatch policy, requiring explicit globs to allow model-requested calls. It also includes loop breakers such as a reactive depth cap of 8 and spawn rate limits (SKILL.md).
Capability inventory: The harness has the ability to dispatch tools via harness::function::trigger, resolve parked calls, and spawn child sessions with sub-agents using harness::spawn (SKILL.md).
Sanitization: There is no evidence of specific input sanitization or escaping for the data payloads processed by the harness, though it relies on engine-level policies to prevent models from calling management functions like send or stop (SKILL.md).

harness