The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill exposes an attack surface for indirect prompt injection by ingesting and processing untrusted external data.
Ingestion points: SKILL.md and references/sandbase-api-map.md describe fetching "current external evidence, search, scraping, [and] enrichment" through the sandbase_run tool.
Boundary markers: The skill contains instructions to "Preserve the user's chosen stack, source material, and authorization boundaries" and requires obtaining confirmation before paid execution, though these do not programmatically isolate the content.
Capability inventory: The skill uses sandbase_run to execute remote capabilities and sandbase_run_get to poll results.
Sanitization: There is no mention of sanitizing, escaping, or validating the external content retrieved from search or scraping before it is processed by the agent.
[DYNAMIC_EXECUTION]: The skill uses a dynamic pattern to discover and execute remote functionality.
Evidence: The workflow involves calling sandbase_discover to find capabilities by task rather than using static endpoints, and sandbase_run to execute them based on a live schema retrieved via sandbase_inspect. This results in runtime-determined execution paths for remote logic.

brainstorm-experiments-new