The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted external content (Evernote notes and attachments), which creates a surface for indirect prompt injection where malicious instructions embedded in notes could attempt to influence the agent.
Ingestion points: External data is ingested through the SyncManager.processSyncChunk and ENMLProcessor.parse methods in references/implementation-guide.md.
Boundary markers: No explicit instructions are provided to the agent to treat note content as untrusted or to ignore embedded instructions, although the code includes a basic sanitize method.
Capability inventory: The implementation guide includes database query capabilities (PostgreSQL) and filesystem operations (read, write, delete) in references/implementation-guide.md.
Sanitization: The ENMLProcessor class uses cheerio for XML parsing and includes methods to strip tags and sanitize sensitive elements, providing a degree of protection against simple injection attempts.

evernote-data-handling