The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes data from external sources and workflow executions, which could contain malicious instructions intended to influence the agent's behavior.
Ingestion points: Untrusted data enters the agent context through executions(action="run"), verify-built-workflow, and reading outputs from executions(action="get-node-output") as described in SKILL.md.
Boundary markers: The skill uses XML-style tags like <workflow-test-request>, <workflow-setup-state>, and <workflow-verification-follow-up> to distinguish system states and user requests from the rest of the conversation.
Capability inventory: The agent can perform significant actions based on processed data, including executing workflows via executions(action="run"), publishing workflows via workflows(action="publish"), and modifying data via data-tables(action="insert-rows").
Sanitization: The instructions recommend inspecting resolvedParameterWarnings and skippedParameterChecks to identify when input data fails to resolve correctly, but it does not specify strict sanitization of the content itself.
[PROMPT_INJECTION]: The skill contains instructions that override the agent's default conversational behavior to streamline the specialized n8n Assistant interface.
Evidence: Instructions in SKILL.md such as "verify immediately... do not acknowledge first", "end the turn", and "Do not tell the user to open the editor" explicitly direct the agent to skip standard response protocols and user guidance steps.
[COMMAND_EXECUTION]: The skill uses tools to trigger workflow executions and system configurations within the sandbox environment.
Evidence: The skill utilizes executions(action="run") and verify-built-workflow to run logic that can interact with external systems. These actions are governed by tool-level approval policies and user-visible HITL (Human-in-the-loop) cards.

post-build-flow