The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill instructions direct the agent to read and follow natural language requests found within a ChatGPT Space page's content and its 'agent_instructions' block.
Ingestion points: Page content and specialized 'agent_instructions' blocks are retrieved via the read_page tool (SKILL.md).
Boundary markers: None are specified. The skill explicitly tells the agent to "Use those requests [in Agent Instructions] to help create or adjust schedules that match what they want," without instructing the agent to treat these external inputs as potentially untrusted data.
Capability inventory: The agent possesses powerful tools including automations.create, automations.update, attach_automation_to_page, and $pages:write-page (SKILL.md).
Sanitization: No sanitization or verification steps are required before the agent acts on instructions found within the processed pages.
[PERSISTENCE]: The skill's primary function is the creation and maintenance of 'automations'—recurring tasks that run independently. While this is the intended use case, it provides an architectural mechanism for persistence. If an indirect prompt injection occurs, an attacker could use it to establish a recurring automated task that continues to execute malicious instructions in the background.
[DYNAMIC_EXECUTION]: The skill instructs the agent to dynamically 'Write the schedule prompt(s)' based on the current page content and inferred user needs. These prompts effectively serve as the 'code' for the automation. Constructing executable instructions from potentially untrusted or attacker-controlled page content increases the risk of the automation performing unintended actions.

manage-schedules