The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill's primary function involves ingesting and processing untrusted data from user drafts and external web sources.
Ingestion points: User-supplied text in SKILL.md (Phase 1) and retrieved web page snippets/URLs in SKILL.md and agents/cove-verifier.md (Phase 2).
Boundary markers: The pipeline uses XML-style tags such as <untrusted_question>, <untrusted_evidence>, and <untrusted_draft> to delimit external data.
Capability inventory: The skill has access to WebSearch and WebFetch tools to interact with external content.
Sanitization: Prompts explicitly instruct the agent to treat tagged content as data, ignore any embedded directives (e.g., "ignore previous instructions", "you are now..."), and extract only factual questions.
[PROMPT_INJECTION]: The skill contains phrases that resemble prompt injection patterns (e.g., "ignore previous instructions"). In this specific context, these are protective security instructions aimed at sanitizing untrusted input processed during verification phases, rather than malicious overrides of the agent's core safety guidelines.
[EXTERNAL_DOWNLOADS]: The skill utilizes external search APIs (Tavily) and web fetching capabilities to retrieve grounding evidence. These are legitimate functions for a fact-verification tool and are documented as targeting well-known services.
[DYNAMIC_EXECUTION]: The reference implementation in the reference/ directory uses JSON schemas to enforce structured communication between processing phases, which minimizes the risk of the agent misinterpreting data as instructions.

cove