The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill identifies an attack surface where the agent processes free-text fields from store data (delivery notes, customer names, product reviews) which may contain instructions from third parties. It provides mitigations by instructing the agent to ignore any instructions embedded in this text and treat it as low-authority evidence.
Ingestion points: SKILL.md references data imported from feeds and buyer-provided text.
Boundary markers: Present; the "Untrusted store text" section defines boundaries and provides "ignore" instructions.
Capability inventory: Access to MCP tools (e.g., create_webhook, kit_request) and shell-based curl commands for API interaction.
Sanitization: Present; instructions specify summarizing or excerpting minimal data.
[REMOTE_CODE_EXECUTION]: The skill uses local scripts for searching and validating documentation. These scripts are self-contained, use only Node.js built-ins, and do not download or execute code from external sources. The allowed-tools configuration scopes execution to these specific files.
[DATA_EXFILTRATION]: API interactions are directed to the official Yandex KIT endpoint. Authentication uses standard environment variables, which is an accepted practice for managing secrets.

a1-yandex-kit-webhooks