The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and prioritize information from an external Iskron graph, which is an untrusted data source.
Ingestion points: Untrusted data enters the agent's context through several tool calls, including iskron_look, iskron_search, iskron_orient, and iskron_case.
Boundary markers: The skill contains no instructions to delimit graph content or ignore embedded instructions. Instead, it explicitly directs the agent to prioritize graph data over its own internal knowledge: "ответ из графа, не из training data и не из кода" (response from the graph, not from training data and not from code).
Capability inventory: The agent possesses write capabilities to the graph via iskron_update and iskron_arrow, meaning a successful injection could potentially alter the graph data permanently.
Sanitization: No evidence of sanitization or validation of graph content is present in the skill instructions.
[METADATA_POISONING]: The description field in the YAML frontmatter contains functional instructions for the agent ("Чтение графа — ПЕРЕД любым ответом...", "Use before answering anything about the user's Iskron graph"). Placing behavioral directives in metadata fields is a form of metadata poisoning.
[COMMAND_EXECUTION]: The skill relies on and documents the execution of a specialized toolset provided by the vendor (iskron_realm, iskron_orient, iskron_search, iskron_look, iskron_case, iskron_history, iskron_stand, iskron_update, iskron_arrow). These tools are used to navigate and modify the vendor's proprietary graph infrastructure.

entry