The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill retrieves content from external Confluence pages, which constitutes an ingestion point for untrusted data that could potentially contain malicious instructions.
Ingestion points: scripts/confluence-get-page.sh and scripts/confluence-search.sh ingest data from the Confluence REST API (page bodies and search metadata).
Boundary markers: The script returns JSON output to the agent; while no specific boundary delimiters are wrapped around the content by the scripts, the SKILL.md instructions explicitly forbid the agent from executing code found in pages.
Capability inventory: The skill possesses network access (restricted to the user-configured CONFLUENCE_URL via curl) and the ability to read local .env configuration files.
Sanitization: No content sanitization is performed by the scripts themselves; the architecture relies on the agent's instructions to maintain safety when processing retrieved text.
[COMMAND_EXECUTION]: The skill uses bash scripts to perform API requests, but implements comprehensive safeguards against injection.
Input Validation: All user-supplied arguments (numeric IDs, search limits, and expansion parameters) are validated using strict regular expressions to prevent command injection.
Secure URL Encoding: The scripts use curl --data-urlencode to handle parameters, ensuring that special characters in queries do not break out of the command structure.
[CREDENTIALS_UNSAFE]: The skill manages API tokens using best practices for local development.
Allowlisting: The .env loader only imports a specific set of recognized variables (CONFLUENCE_URL, CONFLUENCE_API_TOKEN, etc.), ignoring any other keys in the file.
Safety Checks: The loader warns users if their credential file has insecure permissions and rejects values containing control characters to prevent HTTP header injection.

confluence-integration