The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes content from untrusted external sources (SharePoint sites, pages, and files), creating a surface for instructions embedded in those sources to manipulate agent actions.\n
Ingestion points: Data is ingested via get_site, search, and fetch operations (SKILL.md, Workflow steps 1 and 4).\n
Boundary markers: There are no instructions to use boundary markers or delimiters for the ingested content to prevent it from being interpreted as instructions.\n
Capability inventory: The agent has access to sensitive tools such as update_file (file overwrite), create_sharing_link, invite_item_recipients (sharing), and restore_item_version (Workflow steps 6, 7, and 11).\n
Sanitization: The instructions do not define sanitization or validation processes for retrieved content.\n
Mitigation: To mitigate this risk, untrusted content should be delimited with clear instructions to ignore any commands within it, and human verification should be required for actions that modify files or permissions.

sharepoint