The Agent Skills Directory

[PROMPT_INJECTION]: The skill architecture ingests untrusted external data, creating an indirect prompt injection surface that is managed through structural delimiters.
Ingestion points: Untrusted content enters the agent context through the scrape_url tool (lib/scrape-tool.ts), file attachments such as PDFs and CSVs (lib/onboarding-ai.ts), and knowledge base document indexing (lib/knowledge-indexer.ts).
Boundary markers: The skill employs explicit XML-style delimiters (e.g., [USER_CONTEXT], [SYSTEM_FOUNDATION]) and a hardcoded [INSTRUCTION_HIERARCHY] block to maintain authority over ingested data, as detailed in guides/03-prompt-cascade.md.
Capability inventory: The agent has capabilities to perform database updates (lib/onboarding-ai.ts), generate network requests for scraping, and stream responses to the UI.
Sanitization: Includes a prompt-sanitizer.ts utility for administrative prompts; however, runtime data from external scraping is primarily managed via truncation and delimiters rather than full semantic filtering.
[COMMAND_EXECUTION]: Provides a suite of deterministic TypeScript audit scripts (e.g., scripts/audit-untraced-llm-calls.ts and scripts/audit-tenant-id-filters.ts) designed for local or CI execution to statically analyze the host codebase for security gaps.
[SAFE]: Enforces mandatory security principles such as 'Per-tenant isolation' (guides/00-principles.md §5), requiring every vector database query to include a tenant_id filter to prevent cross-tenant data exposure, which is verified by static analysis scripts.

mind-weapon