The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and analyze data from various inbound communication channels that may contain untrusted adversarial content.
Ingestion points: The skill reads inbound message pipelines (Email, Telegram, WhatsApp, LinkedIn) and existing scripts/data files as part of Step 1 (Gather context).
Boundary markers: The execution instructions do not define delimiters or provide warnings to ignore embedded instructions within the processed data.
Capability inventory: The agent has the capability to read files from paths like $SKILLS_PATH and $CRM_PATH and write markdown files to $AGENTS_PATH/specs/.
Sanitization: No sanitization or escaping mechanisms are mentioned for the content retrieved from external communication logs or existing scripts.
[CREDENTIALS_UNSAFE]: The instructions direct the agent to read highly sensitive file paths and contents.
Evidence: Step 1 (Gather context) requires the agent to read "Existing tools (if any) — scripts, API clients" and the CRM schema at $CRM_PATH/schema.yaml. Accessing source code for API clients and database schemas significantly increases the risk of exposing sensitive authentication logic, hardcoded credentials, or internal database structures to the model context.

process-analyst