The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill facilitates the ingestion of content from various untrusted external sources, creating a potential vector for indirect prompt injection.
Ingestion points: The skill instructs the agent to read user-provided files, fetch shared documents via links, and pull information from messaging platforms like Slack and Teams during the Context Gathering stage.
Boundary markers: No specific delimiters, tagging, or instructions to ignore embedded commands within external content are provided to prevent the agent from executing instructions found in that content.
Capability inventory: The skill possesses the ability to create and modify files (using create_file and str_replace) and can invoke sub-agents for testing, which could be abused if the agent is compromised by malicious input from external documents.
Sanitization: The instructions lack mentions of sanitizing, filtering, or validating the data fetched from external integrations or links before it is processed by the agent.

doc-coauthoring