The Agent Skills Directory

[PROMPT_INJECTION]: The skill demonstrates an indirect prompt injection surface through the DurableAgent example.
Ingestion points: The userMessage parameter is ingested directly into the agent context in myAgentWorkflow (SKILL.md).
Boundary markers: None; untrusted user input is passed directly to the DurableAgent.stream method without delimiters.
Capability inventory: Tools such as lookupData utilize the "use step" directive which, according to the documentation, grants 'full Node.js access'. The agent also has access to npx CLI commands (SKILL.md).
Sanitization: There is no evidence of sanitization, filtering, or validation performed on the userMessage before processing.
[PROMPT_INJECTION]: The skill metadata identifies the author as 'Vercel Inc.', which conflicts with the assigned author context of 'rmsite'. This deceptive metadata can lead to misjudgment regarding the skill's origin and safety.
[COMMAND_EXECUTION]: The documentation instructs the user and agent to utilize various CLI tools via npx workflow for debugging and inspecting workflow runs, which involves executing code from the NPM registry.

workflow