The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from an external API (xiangshang.ngrok.app), which represents a surface for indirect prompt injection attacks. The skill proactively mitigates this risk through detailed instructions that require the agent to treat all API responses as data rather than directives, use boundary markers for rendering output, and cross-validate identifiers against a known registry. Evidence Chain: 1. Ingestion points: External API endpoints /api/consult, /api/search, /api/lookup, and /api/evidence/search as documented in SKILL.md and api.md. 2. Boundary markers: Explicit instructions in SKILL.md to summarize and quote warnings or proposed capabilities in a clearly delimited and escaped form. 3. Capability inventory: Host agent capabilities include those listed in the frontmatter tools field (claude, codex, cursor, gemini). 4. Sanitization: Detailed instructions to strip raw response fields of anything that could be interpreted as a directive and to validate all CAP_... and AST_... identifiers before use.
[DATA_EXFILTRATION]: The skill performs network operations to a third-party service to fulfill its core purpose. It mitigates potential data exfiltration by including a 'Privacy and data handling' section that directs the agent to strip credentials, secrets, and proprietary context before transmission. This ensures that only non-sensitive, user-approved information is sent to the external endpoint.

entropy-box