The Agent Skills Directory

[PROMPT_INJECTION]: Static analysis flagged the string "ignore previous instructions" within references/guardrail-and-adversarial.md. This is a false positive as the content is educational documentation explaining how to conduct safety evals and guardrail testing, rather than an attempt to override agent instructions.
[INDIRECT_PROMPT_INJECTION]: The framework facilitates the ingestion of user-supplied data into a long-term memory system (user_memories) which is subsequently included in LLM prompts. This surface is mitigated by several built-in security features:
Ingestion points: Identified in analyst.node.ts and composer.node.ts which handle tool outputs and memory retrieval.
Boundary markers: The renderUserMemoryBlock function in user-memory.ts wraps injected content with explicit headers labeling the text as data and instructions for the model to apply it silently.
Capability inventory: Capabilities are governed by a local allowlist and classification system (capability-governance.md).
Sanitization: The isSensitiveMemory utility uses regex patterns to prevent credentials, account numbers, and PII from being stored in memory.
[DATA_EXPOSURE]: The framework includes detailed observability via a local PostgreSQL database. To prevent exfiltration or exposure of secrets, the argFingerprint and redactSecrets utilities in governance.ts automatically redact common sensitive keys (e.g., api_key, token, password) from execution arguments before they are hashed or logged. Additionally, the SQL schema includes procedures for LGPD/GDPR-compliant anonymization of historical logs.

ns-langgraph-agents