The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill includes an action to import files from external sources which involves making network requests to arbitrary URLs.
Evidence: The importFromUrl action in convex/importFile.ts uses fetch(args.url) to retrieve content from a user-supplied URL.
[INDIRECT_PROMPT_INJECTION]: The skill handles the ingestion of external data, creating a potential surface for indirect prompt injection if the stored files are subsequently processed by an agent without further sanitization.
Ingestion points: User uploads via FileUploader in src/FileUploader.tsx and URL imports via importFromUrl in convex/importFile.ts.
Boundary markers: No specific boundary markers or "ignore instructions" warnings are present in the code snippets for data ingestion.
Capability inventory: The skill has network access (fetch), file storage write capabilities (ctx.storage.store), and database write capabilities (ctx.db.insert).
Sanitization: The saveFile mutation in convex/files.ts performs server-side validation by checking the file size and content type against allowed lists after retrieval from the _storage system table.

convex-file-storage