The Agent Skills Directory

Human-in-the-loop Confirmation: The skill implements a strict security gate requiring explicit user approval before any Slack messages are sent. This prevents the agent from autonomously distributing potentially incorrect or sensitive information without oversight.
Indirect Prompt Injection Surface: The skill is designed to ingest external data from regulatory policy diffs, which represents a potential attack surface for indirect prompt injection.
Ingestion points: Untrusted data enters the context when the agent ingests gaps from the policy-diff process and appends them to gap-tracker.yaml (Mode 1).
Boundary markers: While explicit delimiters are not defined for the ingested data, the skill mandates a "per-send confirmation" rule for all outputs, serving as a procedural boundary.
Capability inventory: The skill possesses the ability to write to local configuration files and matter-specific directories, and can send messages via the Slack MCP.
Sanitization: The skill does not perform automated sanitization of ingested strings but instructs the agent to preserve verification tags (e.g., [verify]) to ensure the user is aware of data reliability risks.
Legal Citation Safety: The instructions include a dedicated section on verifying citations, acknowledging that AI-generated regulatory references may be inaccurate. It requires the agent to display warnings when citations are present in outgoing messages.

gap-surfacer