The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is designed to process and act upon external messages delivered via the agent's prompt, creating a surface for indirect injection attacks.
Ingestion points: The SKILL.md file explicitly states that 'Incoming messages arrive inline in the iteration prompt, batched per iteration'.
Boundary markers: The instructions do not define specific delimiters or explicit 'ignore' instructions for the agent to distinguish between administrative instructions and untrusted message content.
Capability inventory: The skill provides functions to send messages, request replies, and manage channel subscriptions through a local daemon socket via scripts/messages.sh. These capabilities could be misused if a malicious incoming message influences the agent's behavior.
Sanitization: The provided scripts do not perform sanitization or validation of message content; the skill relies on the agent following an instruction to use an external cli-text tool which is not included in this skill package.
[METADATA_POISONING]: There is a discrepancy between the documented capabilities in the skill manifest and the actual implementation in the scripts.
Evidence: The scripts/messages.py script implements several 'group' related management commands (info, status, send, request, observe, and loop) that are entirely omitted from the SKILL.md documentation and usage examples.

messages