The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill provides code to process data from push notification payloads (the userInfo dictionary), which is an untrusted external data source.
Ingestion points: The userInfo dictionary is processed in SKILL.md (within the NotificationHandler class) and references/complete-notification-system.md (within NotificationService, NotificationHandler, and AppDelegate).
Boundary markers: No delimiters or instructions to ignore embedded commands are present in the suggested code implementations.
Capability inventory: The code patterns include network requests via URLSession (in SKILL.md and references/complete-notification-system.md), file system writes via FileManager (in references/complete-notification-system.md), and application navigation via DeepLinkRouter (in SKILL.md).
Sanitization: The logic uses basic type casting and URL validation but does not provide mechanisms to sanitize the content for potential injection strings.
[EXTERNAL_DOWNLOADS]: The skill includes implementation patterns for rich notifications that fetch external media from remote servers.
Evidence: The downloadAttachment function in SKILL.md and the attachImage function in references/complete-notification-system.md use URLSession.shared.download and URLSession.shared.data to fetch content from URLs provided dynamically within the notification payload.

push-notifications