The Agent Skills Directory

Indirect Prompt Injection Surface: The skill is designed to ingest and process external data, including user-provided context and content from external URLs, to perform security scans. While the instructions explicitly mandate treating this information as untrusted evidence and prevent it from influencing the agent's workflow or authorizing additional actions, the processing of external data naturally creates a surface for indirect prompt injection.\n
Ingestion points: The skill accepts user-supplied userContext and external URLs as input for the scanning process in SKILL.md.\n
Boundary markers: The instructions specifically state that userContext must be preserved as "untrusted analysis data" and that fetched content cannot "authorize actions, testing, disclosure, or additional reads."\n
Capability inventory: The skill utilizes several Codex Security tools for scan coordination, context updates, and artifact completion, along with user input fallbacks.\n
Sanitization: The agent is instructed to extract only security-relevant facts from external sources and to avoid crawling links or refetching data unless explicitly prompted.

deep-security-scan