The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill describes workflows that ingest untrusted data from multiple sources which could contain malicious instructions designed to influence agent behavior.
Ingestion points: The research-document workflow performs web collection; the sprint-plan workflow reads local intent files; the gimbal run command accepts arbitrary JSON input via --input.
Boundary markers: No specific delimiters or "ignore previous instructions" warnings are mandated for the interpolation of this external data into the agent's context.
Capability inventory: The skill allows the agent to execute shell commands, manage Docker containers and PostgreSQL databases, write to the filesystem, load Go plugins, and publish to GitHub repositories.
Sanitization: While the skill mentions "repairing or qualifying findings," it lacks technical sanitization or validation rules for content ingested from the web or user-supplied JSON.
[EXTERNAL_DOWNLOADS]: The skill provides instructions to perform network requests to router.diffusion.io using curl to discover available AI models, which involves sending an API key to an external service not listed as a trusted vendor.
[DYNAMIC_EXECUTION]: The system supports loading native Go plugins (.so files) at runtime via the --plugin-dir flag, allowing for the execution of dynamically compiled code within the workflow host.
[COMMAND_EXECUTION]: The skill heavily relies on the execution of system-level tools and subprocesses, including gimbal, jq, docker, psql, node, and ffmpeg. It specifically mentions that shell tools launch child commands, which increases the potential impact of a prompt injection attack.

gimbal-runs