The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill's primary function is to ingest and process content from external, untrusted web pages via the strale_url_to_markdown and context_dev_scrape_markdown tools. This behavior inherently creates a surface for indirect prompt injection attacks where malicious instructions hidden in the scraped content could attempt to manipulate the agent's behavior.
Ingestion points: External web content retrieved using sandbase_call_tool as described in SKILL.md.
Boundary markers: The instructions do not define specific delimiters or instructions to the agent to disregard commands embedded within the retrieved Markdown content.
Capability inventory: The skill uses a tool gateway (sandbase_call_tool) to interact with services but does not contain any direct file system writes, shell command execution, or network exfiltration logic in the provided files.
Sanitization: There are no mentioned mechanisms for sanitizing or filtering the Markdown output for executable scripts or malicious instructions before processing.

url-to-markdown