The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted external data (DAG source code and logs), creating a surface for indirect prompt injection. • Ingestion points: The skill uses get_dag_source_code to read source files and analyse_dag_latest_run to read task logs. • Boundary markers: Instructions do not provide delimiters or specific warnings to ignore instructions embedded in the external content. • Capability inventory: The agent can list DAGs, read source code, analyze runs, and inspect connection metadata. • Sanitization: There is no mention of sanitization or validation for the ingested code or log content.
[DATA_EXFILTRATION]: The skill instructions include using go_to_connections_view to inspect connection metadata. This provides access to potentially sensitive infrastructure configuration and credential-related information.

tracing-upstream-lineage