The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill facilitates the ingestion of untrusted external content (text, images, and documents) which is then passed to large language models. This represents an indirect prompt injection attack surface where malicious instructions could be embedded in the processed data.
Ingestion points: System prompts, user messages, image data, and PDF documents are processed across multiple files, including SKILL.md and examples/vision-documents.md.
Boundary markers: The instructions guide the agent on handling model responses and stop reasons but do not explicitly demonstrate the use of strict boundary delimiters (like XML tags) or specific instructions to ignore embedded commands within the external data being processed.
Capability inventory: The skill uses network capabilities to communicate with the Anthropic API via methods like client.messages.create and client.messages.stream as seen in SKILL.md and examples/core.md.
Sanitization: Although the skill promotes structured output validation using Zod for processing model outputs, it does not detail specific input-side sanitization or filtering of the content before it is sent to the model.

ai-provider-anthropic-sdk