The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is designed to read and process data from a shared volume through tools like volume_read and volume_ls. This content may originate from other agents or external sources, creating an ingestion surface for potentially malicious instructions.
Ingestion points: The volume_read tool and direct file system access (/volume, ~/Cua Volume) provide external file content to the agent context.
Boundary markers: The instructions do not provide specific delimiters or guidance for the agent to distinguish between its instructions and the content of the files it reads.
Capability inventory: The agent has the ability to write to the volume, delete files, and execute shell commands for mount verification.
Sanitization: The skill mentions that the platform scans writes for secrets (secret_detected), but does not define sanitization or validation routines for data being read into the agent's prompt.
[DATA_EXPOSURE]: The skill provides tools for reading and writing to a persistent shared filesystem. It establishes a partitioned layout (agents/<you>/, public/) to scope access, though it includes a formal mechanism (volume_request_access) to expand these permissions.
[CREDENTIALS_UNSAFE]: The skill includes explicit instructions for the agent never to store secrets such as API keys, tokens, passwords, or private keys in the volume, noting that writes are monitored for such data.

cua-volume