The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted scientific protocols and discussion data from external sources.
Ingestion points: Remote data enters the agent context via API responses handled in scripts/protocols_read.py and local JSON imports in scripts/validate_protocol_json.py.
Boundary markers: The SKILL.md and references/discussions.md files provide explicit instructions to the agent to treat all remote content as data and to ignore any instructions embedded within protocol text or comments.
Capability inventory: The skill possesses bounded network access (restricted to protocols.io) and file writing capabilities (restricted to the current working directory) using scripts/protocols_read.py.
Sanitization: The skill employs a centralized sanitize_untrusted function in scripts/_common.py that redacts secrets, removes control characters, and truncates large data structures to prevent context overflow or data leakage.
[DATA_EXFILTRATION]: The skill uses the PROTOCOLS_IO_ACCESS_TOKEN environment variable for authentication. It prevents exfiltration by using a custom HTTP handler that rejects all redirects and strictly validates that network requests are only sent to official protocols.io hosts.

protocolsio-integration