The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes forecast data (titles, scenarios, and evidence summaries) from an external API, which constitutes an indirect prompt injection surface. The author has proactively mitigated this by including a 'Content safety' section with explicit boundary instructions.
Ingestion points: GET requests to worldmonitor.app/api/forecast/v1/get-forecasts and get-forecast-scorecard defined in SKILL.md.
Boundary markers: The skill includes a dedicated 'Content safety' section that warns the agent to treat responses as data, not instructions, and to ignore directive-like text.
Capability inventory: Utilizes curl for API data retrieval.
Sanitization: Employs natural language instructions to prevent the agent from acting on data content.
[COMMAND_EXECUTION]: The skill uses curl commands to interact with the official API. This is the intended functionality for fetching data and does not involve executing untrusted remote code.
[SAFE]: The 'prompt_injection' detector hit is a false positive. The regex triggered on phrases like 'ignore previous instructions' located within the 'Content safety' section; however, these are used as examples of malicious text the agent should ignore, rather than being an attempt to inject commands into the agent itself. The API keys shown are placeholders, and all network activity is restricted to the vendor's primary domain.

check-forecast-signals