The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes user-supplied prompts and conversation history which are interpolated into the agent's context. While the implementation uses headers and path guards, it represents an attack surface for indirect prompt injection.
Ingestion points: User prompts and conversation history arrays are received in templates/route.ts and processed by the askAgent function in templates/agent.ts.
Boundary markers: The skill uses "Previous conversation:" and "New question:" text headers in composePrompt to separate history from current input, but does not implement strict delimiters or escaping for the untrusted content.
Capability inventory: The agent is configured with file-system tools (Read, Glob, Grep) and can be extended with external MCP tools as demonstrated in the Perplexity example.
Sanitization: No explicit prompt sanitization or filtering is applied to the history turns provided by the client before they are passed to the model.
[COMMAND_EXECUTION]: The skill initiates the Claude Code engine as a subprocess to facilitate tool execution. This is the primary function of the skill and is constrained by directory-level path restrictions and an explicit allowlist for tools.
[EXTERNAL_DOWNLOADS]: The skill utilizes official and well-known packages from trusted sources, including the Anthropic Agent SDK, Zod, and Vitest.

embedded-agents-agent-sdk