The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from various ingestion points such as path parameters, query strings, and request bodies, which are then used in application logic.
Ingestion Points: User-provided data enters the agent context via context.parameters.get(), request.uri.queryParameters.get(), and request.decode(as:context:) as documented in SKILL.md and references/routing.md.
Boundary Markers: There are no specific instructions or delimiters mentioned to prevent the agent from interpreting instructions that might be embedded within the processed network data.
Capability Inventory: The skill involves network listening (Application.runService), file system operations (FileMiddleware, FileIO.readFile), and authentication management (HummingbirdAuth).
Sanitization: Documentation examples prioritize type-casting (e.g., using Int.self) but lack explicit sanitization against common vulnerabilities. For instance, the "File Downloads" section in references/routing.md demonstrates constructing a file path directly from a URL parameter (files/\(filename)), which presents a potential path traversal surface.
[EXTERNAL_DOWNLOADS]: The skill references and integrates components from the Hummingbird framework ecosystem.
Evidence: It fetches the core framework from the hummingbird-project repository on GitHub and suggests dependencies for authentication, WebSockets, and database integration (hummingbird-auth, hummingbird-websocket, hummingbird-fluent).

hummingbird