The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is designed to handle inbound emails, which are untrusted external data sources. It correctly identifies this attack surface and provides robust mitigation strategies for developers building AI-driven email agents:
Ingestion points: Untrusted data enters via the message.raw stream and is parsed into text, html, and attachments in references/inbound-mime-parsing.md.
Boundary markers: The skill explicitly recommends isolating untrusted content within XML tags (e.g., <untrusted_customer_email>) and provides a buildSafePrompt helper that instructs the LLM to ignore embedded directives in references/security-and-spam.md.
Capability inventory: The worker implementation has capabilities to write to Cloudflare R2 (env.ATTACHMENTS_BUCKET.put), interact with D1 databases (env.DB.run), and send emails (message.reply, message.forward).
Sanitization: Recommends length limiting (slice(0, 4000)), basic script stripping, and mandatory verification of SPF/DKIM authentication results before performing administrative actions.
[SAFE]: The skill incorporates platform-specific security best practices, such as RFC 3834 compliant loop protection (checking Auto-Submitted and Precedence headers) to prevent infinite auto-responder storms. The prompt injection patterns detected by static analysis are educational examples used in documentation to teach defensive coding and do not represent a threat to the agent or user.

cloudflare-email-workers