The Agent Skills Directory

[PROMPT_INJECTION]: The skill is highly susceptible to indirect prompt injection due to its core functionality of ingesting and summarizing untrusted data from various communication platforms.
Ingestion points: Instructions in examples/3p-updates.md, examples/company-newsletter.md, and examples/faq-answers.md explicitly direct the agent to gather data from Slack posts, Google Drive documents, email threads, and calendar events.
Boundary markers: None identified. There are no instructions to use delimiters or provided warnings to the agent to disregard instructions that may be embedded within the content it reads.
Capability inventory: The agent is authorized to read sensitive organizational data from multiple sources and write summaries for broad internal distribution. While no specific exfiltration tools are defined in the skill itself, the lack of input control creates a risk of data manipulation or unauthorized action triggered by the ingested content.
Sanitization: None identified. The skill does not provide methods for escaping, filtering, or validating the content retrieved from external sources before it is processed by the model.

internal-comms