The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill instructs the agent to fetch content from an external domain (ap2-protocol.org) to guide the implementation of authentication flows. It also directs the agent to perform web searches on GitHub for implementation examples, which results in the ingestion of third-party code and specifications.
[INDIRECT_PROMPT_INJECTION]: The skill has a vulnerability surface for indirect prompt injection because it relies on external, untrusted data to define its core logic and implementation steps.
Ingestion points: The agent is directed to fetch live specifications from https://ap2-protocol.org/ap2/specification/ and https://ap2-protocol.org/ap2/security_and_privacy_considerations/, as well as implementation examples from GitHub via WebSearch.
Boundary markers: There are no instructions to the agent to treat this external content as untrusted or to ignore embedded instructions within the fetched documents.
Capability inventory: The skill allows the use of Write, Edit, and Bash tools, meaning instructions fetched from the external site could influence the agent to write malicious code or execute dangerous commands under the guise of the specification.
Sanitization: There is no evidence of sanitization, validation, or filtering of the content retrieved from these external sources.

ap2-challenge-stepup