The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill defines a procedure for ingesting data from numerous untrusted external sources, which creates a significant attack surface for malicious instructions.
Ingestion points: Data enters the agent context from Jira, Confluence, Slack, external documentation, and the web (SKILL.md).
Boundary markers: While the sample report format uses quotes for verbatim text, the instructions for subagents in the Procedure section do not include directives to ignore instructions embedded in source data.
Capability inventory: The skill utilizes tools to access source repositories, cloud runtime state, and logs, providing a path for potential action if instructions are obeyed.
Sanitization: There are no defined rules for escaping or validating the content retrieved from these external sources.
[DATA_EXFILTRATION]: The skill facilitates the discovery and processing of highly sensitive information categories.
Sensitive data access: The Sources section explicitly targets Cloud runtime state, Cost and billing, and Logs, traces, monitors, and incident history.
Mitigation: The Evidence rules include a directive to "Never print a secret value" and mandate "read-only" queries, which provides some protection against accidental credential exposure.

archeology