The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The TypeScript example in SKILL.md imports from @claude-ai/sdk, which is not the official Anthropic SDK (the official package is anthropic). Referencing unverified packages from unofficial namespaces is a security risk as it may lead to the installation of malicious code or typosquatted libraries. \n- [INDIRECT_PROMPT_INJECTION]: The skill demonstrates batch processing of external data (referenced as the documents variable) without providing boundary markers or sanitization logic. This pattern allows for potential indirect prompt injection if the source documents contain adversarial instructions intended to hijack the agent's behavior. \n
Ingestion points: The documents array/list processed in both TypeScript and Python examples in SKILL.md. \n
Boundary markers: The prompt templates lack delimiters like XML tags or explicit safety instructions to isolate untrusted data from the summary instruction. \n
Capability inventory: The skill is configured with broad permissions including Read, Write, Edit, and Bash in its YAML frontmatter. \n
Sanitization: No validation or filtering is demonstrated for the document content before interpolation into the prompt.

clade-webhooks-events