The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is designed to process untrusted external data such as vulnerability scanner reports, ticket descriptions, and vendor advisories. While this represents an attack surface for indirect prompt injection, the skill includes a dedicated 'Prompt Injection Safety Notice' that explicitly instructs the agent to ignore any embedded instructions found within that data.
Ingestion points: Vulnerability inventory findings, ticket descriptions, and external advisory text (SKILL.md).
Boundary markers: The skill instructions provide clear logical separation for analysis steps, though specific string delimiters for data are not enforced.
Capability inventory: The skill uses Read, Grep, and Glob tools to inspect files and directories.
Sanitization: Includes explicit negative constraints in the 'Prompt Injection Safety Notice' to disregard instructions directed at the AI agent within processed data.
[EXTERNAL_DOWNLOADS]: The skill references and fetches data from the official EPSS API (api.first.org) maintained by FIRST.org and refers to the CISA KEV catalog. These are well-known, authoritative industry services used for vulnerability enrichment and do not represent a security risk.

patch-prioritization