The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted meeting transcripts from various sources including local files, URLs, and pasted text. These transcripts are processed by subagents across multiple steps (Clean, Translate, Extract) to produce summaries and action items. The subagent prompts do not use boundary markers or delimiters to separate the transcript data from the subagent's instructions, nor do they include warnings to ignore embedded instructions. This creates a surface for indirect prompt injection if a transcript contains malicious text designed to influence the agent's behavior.
Ingestion points: The skill reads transcript data from meetings/tmp/meeting-stripped.txt and its subsequent processed versions in SKILL.md Steps 2, 3, and 4.
Boundary markers: Absent. The transcript content is simply passed as the subject of the subagent prompts.
Capability inventory: The skill possesses the capability to execute shell commands (Bash), run Python scripts (uv), write files, and invoke subagents.
Sanitization: No sanitization or escaping of the transcript content is performed before it is presented to the subagents.
[COMMAND_EXECUTION]: The skill constructs and executes shell commands that incorporate file paths resolved from the filesystem. In Step 1, the <input> variable is placed within double quotes in a Bash command. If a file in the resolved folder (such as ~/Downloads/) has a name containing shell metacharacters, specifically command substitution sequences (e.g., $(...) or backticks), the shell may execute those sequences during the expansion of the command.
Evidence: The execution string in Step 1: uv run "$SKILL_SCRIPT" "<input>" "${PROJECT_ROOT}/meetings/tmp/meeting-stripped.txt".
[EXTERNAL_DOWNLOADS]: The skill includes functionality to download files from arbitrary, user-provided URLs using curl.
Evidence: Step 0, Rule 7: curl -sL <url> -o meetings/tmp/transcript.vtt via Bash.

meeting-minutes