The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted external data, including incident logs, customer communications, and user notes, to generate structured postmortems and action items. This ingestion of untrusted content without explicit delimiters or sanitization instructions creates a surface for indirect prompt injection where instructions embedded in logs could influence the agent's behavior.
Ingestion points: Reads from user-provided incident notes, external communications, and system logs as described in the 'Required Inputs' section of SKILL.md.
Boundary markers: The instructions do not mandate the use of delimiters (e.g., XML tags or triple quotes) when the agent processes logs or customer messages to prevent them from being interpreted as instructions.
Capability inventory: The skill is authorized to write to a local professional-brain (specifically decisions/ and knowledge/ directories) and suggests tasks for an action-runner tool that can file issues or execute commands.
Sanitization: There is no explicit logic for sanitizing or escaping the content of incident notes before they are interpolated into the postmortem template or passed to downstream tools.

incident-postmortem