The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is designed to process untrusted external inputs, including brand guides (PDFs), organization URLs, and prior persona documents, to create agent personas and encoding instructions for Agentforce. This process creates a surface for indirect prompt injection, where malicious content in the source data could manipulate the agent's design choices or output instructions.
Ingestion points: SKILL.md (Design Flow -> Step 1: Input) explicitly allows for the ingestion of brand guides, URLs, and other external text-based descriptions.
Boundary markers: The instructions do not define any explicit boundary markers or include directions to the agent to disregard instructions embedded within the ingested source material.
Capability inventory: The skill utilizes the Write tool to generate and store markdown files in the _local/generated/ directory, and Read, Glob, and Grep for managing local file context.
Sanitization: There is no logic provided to sanitize, validate, or escape the content extracted from external sources before it is used to generate the persona document or encoding YAML/configuration.

sf-ai-agentforce-persona