The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from the user and external search engines, which could potentially contain malicious instructions intended to influence the agent's behavior.
Ingestion points: Untrusted data enters the context via inputs.user_message in the trip_collect and trip_preferences steps, and through search results in the constraints, itinerary, and final_plan steps (SKILL.md).
Boundary markers: The skill uses xml_escape and truncate on user input, and uses text labels like "Original user request:" to delimit data, which provides basic but not foolproof separation.
Capability inventory: The skill has the capability to execute external skills (weather, multi-search-engine) and perform multiple llm_chat operations based on processed data.
Sanitization: xml_escape is applied to the primary user input, but external content from search results (POI search) is interpolated without specific escaping or schema validation beyond truncation.

meta-travel-planner