The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill provides a mechanism for exposing browser-side tools to AI agents, which creates a surface for indirect prompt injection if the tools process untrusted data from the web application or external APIs.
Ingestion points: Tools are registered via document.modelContext.registerTool and receive data through an input object, as documented in SKILL.md and assets/model-context-registry.template.ts.
Boundary markers: The skill explicitly instructs developers to use annotations.untrustedContentHint when tool output may contain untrusted data to signal the agent to handle the content with caution (SKILL.md Step 3.7 and references/webmcp-reference.md).
Capability inventory: Implementation examples demonstrate that tools can perform network operations using fetch() and modify application UI state (references/webmcp-reference.md and references/troubleshooting.md).
Sanitization: The instructions advise validating business rules within the tool implementation and returning descriptive errors to guide the agent, providing a layer of protection against unexpected inputs (SKILL.md Step 3.8).

webmcp