The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from external GitHub repositories (e.g., manifest files like package.json and configuration files like FUNDING.yml) and responses from external APIs (deps.dev, npmjs.org, and general web search). An attacker could potentially embed malicious instructions within these project files or API-served content.
Ingestion points: The agent uses get_file_contents to read repository files and web_fetch to retrieve data from public package registries and dependency APIs. It also uses web_search for secondary research.
Boundary markers: The instructions do not specify the use of delimiters or specific instructions to disregard natural language commands embedded within the fetched data.
Capability inventory: The agent's capabilities are limited to network operations (web_fetch, web_search) and reading files (get_file_contents). It lacks capabilities for local file system modification, command execution, or persistence.
Sanitization: The skill includes a requirement to verify every funding link before presentation to the user, which serves as a basic validation step for output, though it does not explicitly sanitize data for prompt injection.
[SAFE]: The skill uses well-known and trusted external services for its operations. All primary dependency resolution is directed to Google's deps.dev API and the official npm registry. Repository interactions are limited to public or user-authorized GitHub metadata. The behavior aligns exactly with the stated purpose of finding sponsorship opportunities.

sponsor-finder