The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill implements an architecture that processes external data (prompts and documents) through AI models, which is an inherent attack surface.
Ingestion points: Python code in SKILL.md accepts prompt and doc variables for processing.
Boundary markers: The Instructions section requires validating all requests against an allowlist and using synthetic fixtures for testing.
Capability inventory: The skill uses the requests library for callbacks and has Bash(npm:*) tool access.
Sanitization: Explicit instructions are provided to redact sensitive information (prompts, completions, API keys) from logs and to use authenticated internal destinations for callback notifications.
[COMMAND_EXECUTION]: The skill configuration requests Bash access scoped to npm:*, which is standard for managing Node.js dependencies in development workflows.
[DATA_EXFILTRATION]: While the code includes network operations via requests.post, this is documented as a specific mechanism for application-owned asynchronous callbacks. The security instructions mandate the use of authenticated internal destinations to prevent data leakage.

anth-webhooks-events