The Agent Skills Directory

[PROMPT_INJECTION]: The skill documentation outlines defensive measures where tool dispatch is "deny-by-default." It explicitly restricts the model from invoking sensitive turn-management functions like send, run, or stop, permitting only spawn under strict policy controls.
[INDIRECT_PROMPT_INJECTION]:
Ingestion points: Untrusted data enters the agent context through trigger payloads in harness::send and via registration metadata in harness::react (SKILL.md).
Boundary markers: The harness uses options.functions.allow globs to explicitly define and restrict capabilities per turn.
Capability inventory: The harness can spawn sub-agents, dispatch tools, and execute synchronous hooks for policy enforcement.
Sanitization: The system enforces a reactive depth cap of 8, rate limits for spawns, and ensures sub-agents inherit a read-only baseline policy unless explicitly granted more.
[PRIVILEGE_ESCALATION]: The harness architecture is designed to prevent privilege escalation by requiring child agents (spawn) to inherit either a subset of the parent's policy or a read-only default baseline, ensuring that sub-agents cannot acquire more permissions than their caller.
[DATA_EXFILTRATION]: No evidence of unauthorized data exfiltration was found. The harness manages transcript storage and state through internal components like session-manager and context-manager rather than external endpoints.

harness