The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill provides tools to read and list contents from remote workspaces, which are ingestion points for untrusted data.
Ingestion points: The workspace_file_read and workspace_file_list tools in SKILL.md allow the agent to pull content from external files into its context.
Boundary markers: The instructions do not define delimiters or specific warnings to ignore instructions found within the processed workspace files.
Capability inventory: The skill allows file writing (workspace_file_write), workspace listing, and detailed metadata retrieval, providing a broad set of actions that could be triggered by malicious content in a read file.
Sanitization: There are no requirements for sanitizing or escaping the content retrieved from remote nodes before the agent processes it.

yao-workspace