The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill possesses an inherent attack surface for indirect prompt injection because it is designed to ingest and process data from various external third-party API providers.
Ingestion points: Untrusted data enters the agent's context through call_platform_api responses from external integrations (Proxy and Unified APIs) and through system logs retrieved via GET /log that contain provider-supplied messages.
Boundary markers: The playbooks do not explicitly instruct the agent to use specific delimiters or protective framing when processing or outputting text derived from external integrations to prevent instructions embedded in that data from influencing the agent's behavior.
Capability inventory: The agent has the ability to execute state-changing operations across the workspace, including POST, PATCH, and DELETE requests via call_platform_api, although these are described as being gated by user approval.
Sanitization: The instructions highlight that the platform uses automated redaction (x-assistant-deny-fields) for sensitive fields like secrets and tokens, providing a mitigation against data exposure during processing.
[NO_CODE]: The skill consists entirely of markdown documentation and playbooks. It does not include any executable scripts, binary files, or configuration files that would require code analysis.

truto-operator