The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill architecture creates a vulnerability surface where an LLM-powered 'Brain job' processes untrusted data from external sources.
Ingestion points: Data enters the agent's context through duoduo session notify messages, as described in SKILL.md and the 'Mechanical layer' section of references/pattern-mechanical-brain.md.
Boundary markers: The documentation does not provide or recommend the use of delimiters (e.g., XML tags or backticks) or 'ignore embedded instructions' warnings to isolate external data from the system prompt.
Capability inventory: The 'Brain job' is designed to use powerful tools, including Bash (shell execution) and WebFetch (network operations), as detailed in the 'Optional SDK configuration keys' section of references/pattern-mechanical-brain.md.
Sanitization: There are no instructions or examples for sanitizing, validating, or filtering external content before it is interpolated into the brain job's prompt.

duoduo-pipeline