The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes external data from the protocols.io API, which could potentially contain malicious instructions within protocol steps or comments.
Ingestion points: Data enters the agent's context through scripts/protocols_read.py (network API responses) and scripts/validate_protocol_json.py (processing local JSON snapshots).
Boundary markers: SKILL.md (Operating Contract #7) and references/discussions.md provide explicit instructions for the agent to treat all remote content as untrusted data and ignore any embedded instructions.
Capability inventory: Capabilities include allowlisted HTTPS GET requests and writing to new private files (0600 permissions). Mutations are limited to a planning phase and do not execute automatically.
Sanitization: scripts/_common.py implements robust sanitization via sanitize_untrusted, which redacts secrets, and clean_text, which filters control characters.
[SAFE]: The skill follows security best practices across all modules.
Directory traversal is prevented via _path_inside_cwd in scripts/_common.py which validates that paths remain within the current working directory.
Credential leakage is mitigated by using named environment variables, disabling HTTP redirects, and strictly allowlisting official hostnames.
The skill requires no external dependencies, relying solely on the Python standard library, which minimizes the supply chain attack surface.
All mutations require a two-step process: generating a dry-run plan followed by explicit human confirmation.

protocolsio-integration