The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill maintains an indirect prompt injection surface by processing untrusted data from the web and reflecting it in generated output files.
Ingestion points: External travel trends, gourmet spot reviews, and pricing data retrieved via browser search tools from platforms such as YouTube, Naver, and Instagram (as described in SKILL.md and references/trip_planning_playbook.md).
Boundary markers: Absent. There are no explicit instructions for the agent to ignore or delimit potentially malicious instructions within the retrieved external data.
Capability inventory: The agent has capabilities to perform network searches via browser tools and write files to the local system (SKILL.md).
Sanitization: The skill implements basic escaping of HTML and XML entities in most deliverables (resources/generate_maps_data.py, examples/danang_pocket_guide.html). However, the danang_trip_cards.html template uses innerHTML for rendering itinerary descriptions, which represents a potential cross-site scripting (XSS) vector if malicious content is processed.
[EXTERNAL_DOWNLOADS]: The web application templates provided with the skill reference external scripts from established third-party services.
Evidence: The templates resources/ios_card_app_template.html and resources/pocket_guide_app_template.html include script tags pointing to cdn.tailwindcss.com and unpkg.com (@phosphor-icons/web). These are well-known and standard services used for web asset delivery and do not represent an unusual security risk beyond typical supply chain considerations.

trip-planner