The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill has a potential attack surface for indirect prompt injection because it is instructed to ingest and process local files and user inputs.
Ingestion points: SKILL.md (Workflow Step 1) directs the agent to inspect available files, runtime, versions, and inputs.
Boundary markers: The skill lacks instructions for using delimiters or explicit warnings to disregard any instructions contained within the ingested data.
Capability inventory: The skill can perform complex symbolic calculations locally and execute external model inference or data retrieval via the sandbase_run tool.
Sanitization: There is no mention of sanitizing or filtering input data before it is processed or used in external calls.
[EXTERNAL_DOWNLOADS]: The skill utilizes external capabilities via sandbaseai vendor tools (sandbase_discover, sandbase_inspect, sandbase_run) for data retrieval and inference.
The instructions include safety protocols, such as requiring user confirmation of the endpoint and cost estimate before execution, and limiting data transmission to the minimum necessary.

sympy