The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill documents integration with external data sources like Gravity Forms, the WordPress REST API, and an Abilities API, which creates a surface for indirect prompt injection if untrusted input is processed without strict validation.
Ingestion points: Data enters the context via register_rest_field (REST API), Gravity Forms submissions (pods-gravity-forms), and the custom wp_register_ability endpoint defined in SKILL.md.
Boundary markers: No specific delimiters or instructions to ignore embedded commands are included in the prompt templates provided in the context section.
Capability inventory: The skill uses pods_save for database writes and pods_field for data retrieval, which could be leveraged to store or retrieve malicious payloads.
Sanitization: The provided PHP snippets do not include explicit input sanitization or escaping (e.g., sanitize_text_field), though this is common for brief documentation examples.

wp-pods