The Agent Skills Directory

[PROMPT_INJECTION]: The skill processes potentially untrusted user messages but mitigates injection risks by wrapping inputs in XML escape tags and truncating long strings in the intake and local_context steps.
[COMMAND_EXECUTION]: Although the skill metadata lists shell and filesystem-read capabilities, the internal instructions prioritize safe diagnostics. It specifically directs the agent to 'propose read-only checks' for Docker, Git, and deployment cases, and ensures commands generated for the user have clearly stated purposes.
[INDIRECT_PROMPT_INJECTION]: The skill provides an interface for processing external data such as logs and command outputs.
Ingestion points: The intake and local_context steps in SKILL.md ingest untrusted user content from inputs.user_message.
Boundary markers: The skill uses XML escaping and explicit block framing (e.g., 'Request: {{...}}') to separate data from system instructions.
Capability inventory: The skill has access to shell, network, and filesystem-read via its metadata configuration.
Sanitization: Input is sanitized using the xml_escape filter and restricted via truncate (to 4000 and 5000 characters) to prevent large-scale payload injections.

meta-home-it-rescue