The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill defines a persistence architecture for ingesting and storing chat transcripts and generated media, which presents a surface for indirect prompt injection through user messages or remote artifact content.
Ingestion points: User-supplied chat messages and parameters are parsed from incoming requests using chatParamsFromRequest in SKILL.md and server/SKILL.md.
Boundary markers: Not explicitly defined in the provided implementation templates, as the logic is intended to be integrated into broader application middleware.
Capability inventory: Facilitates stateful database operations (CRUD) for messages and runs across various backends (D1, Postgres, etc.) and performs network requests to fetch remote media artifacts in withGenerationPersistence.
Sanitization: The documentation mandates critical security controls, including SSRF mitigations (blocking loopback/private IP addresses), user-controlled URL whitelisting via the allowInputUrl predicate, and mandatory per-request authorization checks (authorize callback) for thread access.
[SAFE]: All referenced libraries, dependencies, and external services (e.g., @tanstack/*, Cloudflare, Prisma, Drizzle, AWS, Google Cloud) are well-known technology providers or originate from the skill's official vendor.

ai-persistence