The Agent Skills Directory

[PROMPT_INJECTION]: Static analysis identified potential prompt injection strings (e.g., 'ignore previous instructions'). Analysis confirms these are false positives; they appear within code examples for building security filters and guardrail logic designed to detect and prevent injection attacks.
[PERSISTENCE]: The skill instructs the agent to write outcome metrics to a local JSON file at ~/.claude/skill-analytics/last-outcome-langgraph-agents.json. This is used for session tracking and analytics rather than malicious persistence.
[INDIRECT_PROMPT_INJECTION]: The skill provides an architecture for agents to process user-supplied data. While this creates an attack surface for indirect injection, the skill explicitly provides remediation patterns:
Ingestion points: Data enters the system via graph.invoke or supervisor.invoke methods in SKILL.md and reference/orchestration-patterns.md.
Boundary markers: The documentation recommends the use of structured output and message delimiters to isolate untrusted input.
Capability inventory: Agents are configured with tools for file access, web search, and sandboxed shell command execution (execute_command) as described in reference/deep-agents.md.
Sanitization: The skill includes a dedicated deep-dive (reference/guardrails.md) demonstrating PII redaction and keyword-based injection detection filters.
[COMMAND_EXECUTION]: The skill documentation describes the integration of tools that can execute shell commands (execute_command) and local process management via MCP servers using npx. These are presented as part of a controlled agent harness with sandboxing recommendations.
[EXTERNAL_DOWNLOADS]: The skill references the Model Context Protocol (MCP) for dynamic tool loading. Examples include fetching configuration from official repositories like @anthropic/mcp-server-files, which are well-known services and trusted providers.

langgraph-agents