The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The agent orchestration templates define an architecture where untrusted data is directly mixed with system instructions, creating a vulnerability to indirect prompt injection.
Ingestion points: Untrusted data is ingested via the query parameter in the Agent.run and select_tools functions, as well as through tool outputs stored in AgentState.tool_results within SKILL.md.
Boundary markers: The prompt templates in build_planning_prompt and tool_selection_prompt lack delimiters (such as triple backticks, XML tags, or markers) to separate the agent's instructions from the dynamic content interpolated from external sources.
Capability inventory: The architecture enables the execution of various tools including search_web, query_database, and call_api, which could be manipulated by adversarial input injected into the context.
Sanitization: The provided code logic does not implement any escaping, filtering, or validation of the input strings before they are formatted into the prompts sent to the LLM.

agent-orchestration-planner