The Agent Skills Directory

[PROMPT_INJECTION]: The skill contains instructions that were flagged as a potential override. However, these instructions are located in the 'Content safety' section and are defensive in nature. They explicitly instruct the agent to ignore any directive-like text found within the external API data (indirect prompt injection protection), which is a security best practice.
[CREDENTIALS_UNSAFE]: The documentation includes an example API key (wm_0123456789abcdef0123456789abcdef01234567). This is a generic hex string used for illustrative purposes in the authentication example and does not constitute a leak of live production credentials.
[EXTERNAL_DOWNLOADS]: The skill makes legitimate requests to api.worldmonitor.app to fetch energy disruption events. This is the primary intended function of the skill and the domain is consistent with the provided documentation and references.
[DATA_EXPOSURE]: This skill possesses an indirect prompt injection attack surface as it ingests data from an external source.
Ingestion points: Data is ingested through fields like shortDescription and sources in the API response from SKILL.md.
Boundary markers: The skill includes a dedicated 'Content safety' section that warns the agent to treat responses as data, not instructions.
Capability inventory: The skill is limited to making network requests to the vendor's API and does not have access to local file systems or shell execution.
Sanitization: The instructions explicitly tell the agent to disregard and not execute any instructions found within the data payloads.

monitor-energy-disruptions