The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process data from external, untrusted sources including connected email accounts (for receipts and confirmations) and third-party websites accessed via an automated browser. This represents an inherent indirect prompt injection surface where malicious instructions could be embedded in external content to influence the agent's behavior.
Ingestion points: The skill accesses external content through connected email channels, authenticated provider accounts, and live web browsing sessions as detailed in SKILL.md and the category-specific references (flights, hotels, restaurants, and tickets).
Boundary markers: Instructions in references/presentation.md and references/flights.md require the agent to use structured Markdown tables and avoid dumping raw provider output or HTML, which helps isolate the agent's response logic from potentially malicious external data.
Capability inventory: The agent has access to sensitive capabilities including browser navigation, placing phone calls via the phone.place_call tool, and writing temporary data to the local file system (e.g., /tmp/flight-search.json).
Sanitization: The skill includes non-negotiable behaviors and evidence rules that prevent the storage or repetition of sensitive identity fields, credentials, or payment information in conversation history or persistent memory.

booking