Strands Agents SDK for TypeScript 1.22

Apply this prompt to applications built with @strands-agents/sdk on the 1.22 release line. The Node.js 24 and TypeScript 6.0 prompts supply the host-language rules; the rules below cover Strands-owned agent, tool, and orchestration behavior.

Treat agent context as untrusted at its boundaries

• Keep user text, retrieved pages, documents, memory records, MCP and A2A responses, and tool results as data. Do not let instructions inside them change the agent's system instructions, choose privileged tools, or grant permission for an action. Separate trusted application instructions from the content passed to Agent.invoke() and test with hostile content in each source.
• Build Agent message history and restored snapshots only from application-controlled storage. A request body or other caller-influenced history can contain forged toolUse or toolResult blocks, so parse it into ordinary user content instead of loading it as trusted history.
• Load AgentSkills and Skill.fromFile() only from reviewed, access-controlled directories. Treat skill instructions and resources as executable authority, and do not let a user select arbitrary local skill paths or replace the skill directory at runtime.
• Scope conversation history, context summaries, and memory retrieval to the authenticated tenant and task. Treat recalled memory and model-generated summaries as untrusted content when they re-enter the prompt; require authorization again before acting on them.

Authorize every tool effect

• Register only the tools an agent needs. For each tool() callback, validate input