The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill directs the agent to analyze instance state—including workflow names, recent changes, and activity logs—to resolve vague user commands or resume work. This data represents an untrusted ingestion surface where a malicious user could embed instructions within resource names or metadata to influence agent behavior.
Ingestion points: Data enters the agent context via the <instance-context> block, as well as the results from activity(action="list"), activity(action="expand"), and workflows(action="get") described in SKILL.md.
Boundary markers: The skill does not provide specific instructions or delimiters to help the agent distinguish between descriptive metadata and potential malicious instructions hidden within those fields.
Capability inventory: The skill is designed to work with the activity, workflows, executions, and credentials tools to read and manage the instance state.
Sanitization: There are no explicit requirements for the agent to sanitize, validate, or ignore instructional language found within the resource data it is encouraged to "Look up."

instance-awareness