The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill defines callbacks for processing external data from WebRTC clients, which constitutes a surface for untrusted data to enter the application context.
Ingestion points: The documentation specifies on_clipboard, on_app_message, on_unicode, and on_message as primary entry points for data from the remote browser client.
Boundary markers: The instructions do not specify the use of delimiters or instructions for the agent to ignore potentially malicious embedded content within the payloads.
Capability inventory: The skill frontmatter allows the use of Read and Grep tools; applications implementing the SDK may have broader capabilities.
Sanitization: The SDK performs transport-level validation (e.g., 16 MiB reassembly limits for clipboard, 64 KB per-packet limits, and basic JSON envelope parsing for app messages), but content-level sanitization is not enforced.

stream-messages