The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill displays untrusted content fetched from an external database back to the agent's context, which could allow a malicious user to influence the agent's behavior via stored reminders.
Ingestion points: The get_reminders method in handler.ts fetches reminder data from an internal API endpoint (/api/reminders). The create_reminder method also returns text from a duplicate reminder object if a collision is detected.
Boundary markers: The skill lacks explicit delimiters or warnings (e.g., XML tags or clear labels) to inform the agent that the reminder text contains untrusted data that should not be followed as instructions.
Capability inventory: The skill maintains network access via fetch calls to an internal API for reminder operations, though these are scoped to the project's own backend.
Sanitization: There is no sanitization or escaping of the r.text field before it is interpolated into the formatted string returned to the agent in both get_reminders and the duplicate detection logic in create_reminder.

reminders