The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill documents the aiSkill() BIF, which allows agents to ingest external markdown content from the filesystem (e.g., from .agents/skills/) into their system context. This creates a surface for indirect prompt injection where malicious instructions in loaded files could influence the agent's behavior.
Ingestion points: aiSkill() is documented to load content from specific file paths or by scanning entire directories to be injected into the skills and availableSkills pools.
Boundary markers: The documentation lacks specific delimiters or "ignore" instructions for the agent when processing these external skill files.
Capability inventory: The documented framework supports tools for database queries (queryExecute) and network-based communication via MCP servers.
Sanitization: No mechanisms for sanitizing or validating the content of loaded skill files are described.
[COMMAND_EXECUTION]: The documentation includes examples of defining tools that execute logic, such as queryExecute for database lookups and getWeatherData for external API calls, using arguments derived from model input. While the examples demonstrate safe parameterization, they define the capability for the agent to execute operations based on processed data.

bx-ai-agents