Internet skills should guide an agent, not control it

OWASP defines prompt injection as crafted input that changes a model's intended behavior. Indirect injection can arrive through websites, files, and other external sources. A public skill URL is therefore both a customization feature and an untrusted content channel.

The loader should treat the fetched text as data inside a clearly delimited skill block. The system prompt should state which instructions outrank it. The runtime should independently enforce permissions, because a language model cannot be the only security boundary around its own tools.

Content may also change after review. A URL that was safe yesterday can return different text today because the owner updated it, the domain changed hands, or an upstream dependency was compromised. Fetch time and content identity are therefore part of the security record.

Fetching an arbitrary URL can expose internal services through server-side request forgery. Limit skills to public HTTPS, resolve and validate DNS results, block private and loopback addresses, revalidate redirects, cap bytes and time, and accept only plain text or Markdown content types.

A useful skill names its intended tasks, prerequisites, decision points, expected outputs, verification steps, and conditions for stopping. Instructions such as make it better or use best practices are difficult to test because they do not define observable behavior.

Keep tool references capability-based where possible. Ask to verify the build rather than assuming one package manager command; ask to consult primary documentation rather than hard-coding an unrelated search provider. Host-specific adapters can translate the procedure into available tools.

Include negative boundaries. A deployment skill should say which environments are in scope, whether destructive operations are excluded, and what requires user approval. These limits complement runtime enforcement and help the model form a safer plan before it reaches a permission gate.

Show the active skill name and source before the request runs. Let users inspect the text, reload it deliberately, disable it for one message, and remove it without losing the conversation. Visibility helps users understand why the agent followed a particular workflow.

For repeatability, record the content hash used for each run. A mutable URL can return different instructions tomorrow. Versioning or pinning the fetched content makes failures easier to reproduce while still allowing an explicit update path.

A preview should show meaningful metadata without forcing the user to trust a title declared inside the remote file. Display the host, final URL, fetch time, and whether the content changed since the last approved version. A diff is more useful than a generic updated badge.

Test whether the skill improves the target workflow on representative tasks. Measure adherence to required steps, output usefulness, unnecessary tool calls, verification quality, and the amount of correction a user needs.

Then test the boundary. Place conflicting instructions in referenced pages, request tools that are not granted, redirect the skill URL toward a private target, return an oversized file, and change the remote content after approval. The expected result is safe degradation, not creative compliance.

Version the skill and its evaluation set together. When the procedure changes, rerun the cases that protect authority, network access, and destructive actions. A readable Markdown file is easy to change; that convenience should be paired with change review.

A skill may say that a test should be run or a page should be researched. The platform decides whether the corresponding tool exists, whether the current user can call it, and whether approval is required. This separation keeps customization useful without confusing guidance with authority.

If the skill cannot be loaded or conflicts with a higher-priority rule, the product should explain that limitation and continue with its built-in behavior when safe. Remote customization should enhance the service, not become a single point of failure for ordinary work.