The Agent Skills Directory

Indirect Prompt Injection Surface: The skill is designed to ingest and summarize data from external, untrusted sources including customer emails, chat transcripts, and external documents. This creates a potential surface where malicious instructions could be embedded in the processed content to influence the agent's behavior.
Ingestion points: Data enters the agent context through the calendar, CRM, email, and transcripts tools (SKILL.md).
Boundary markers: The skill explicitly labels these sources as 'untrusted content' and instructs the agent to treat them strictly as data, not as instructions.
Capability inventory: The skill can perform actions like updating records, sending emails, and posting to chat (SKILL.md).
Sanitization: The instructions include multiple defensive measures: reporting instruction-like text instead of acting on it, refusing to render links found within untrusted content, and requiring explicit human review for any 'content-originated' actions before they are executed. In scheduled runs, these actions are converted to proposals rather than being performed automatically.
Data Access and Scope Management: The skill accesses sensitive information across various enterprise tools to generate the morning briefing.
Scope Limitation: A rule is present to prevent the agent from silently widening data access to organization-wide scope, requiring it to stop and ask for clarification if the personal scope is empty.
Linking Safety: The skill follows a strict policy of using only connector-provided web links or tool-specific ID schemes for record links, explicitly prohibiting URL guessing to prevent potential link spoofing.

daily-briefing