The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is designed to inspect and modify existing codebases, which creates a surface for processing untrusted data.
Ingestion points: Workflow step 1 involves inspecting repository files, runtime environments, and user-provided inputs.
Boundary markers: The instructions do not specify the use of delimiters or 'ignore' instructions to prevent the agent from potentially obeying malicious prompts embedded in the source code being analyzed.
Capability inventory: The skill has capabilities to perform network calls via the sandbase_run tool and is authorized to create implementation artifacts and configuration files.
Sanitization: There are no requirements for sanitizing, escaping, or filtering content retrieved from the external source files before it is processed by the model.
[EXTERNAL_DOWNLOADS]: The skill retrieves capability schemas and documentation from the vendor's platform using the sandbase_discover and sandbase_inspect tools. The risk is managed by requiring the agent to present schemas and estimates to the user.
[DATA_EXFILTRATION]: The skill sends data to external endpoints through the sandbase_run tool. This is documented as a core function for external documentation or model inference, with instructions to minimize the data sent and obtain user confirmation for the endpoint and cost prior to execution.

google-cloud-waf-operational-excellence