The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and analyze untrusted data from agent runs, which presents a surface for indirect prompt injection.
Ingestion points: The skill reads run messages, tool outputs, and files (such as final_message, dispatch_tree metadata, and external files generated by other agents or fetched from the web) as described in SKILL.md.
Boundary markers: The skill contains a dedicated 'Untrusted content' section that explicitly instructs the agent to treat all run content as data rather than instructions, establishing a clear logical boundary.
Capability inventory: The skill utilizes data retrieval tools (e.g., get_agent_run, get_agent_run_file, get_agent_run_step) and references configuration editing tools that might be available in the broader agent environment.
Sanitization: The instructions mandate quoting untrusted content rather than executing it and explicitly forbid calling sensitive tools like edit_agent_config based on run data, providing strong instructional sanitization.

sitefire-traces