The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes transcribed voice clips from Slack as primary input. This untrusted data is treated identically to text messages, creating a surface for indirect prompt injection attacks where malicious instructions hidden in the voice clip could influence the agent's subsequent actions.
Ingestion points: Slack voice clip transcripts ingested in SKILL.md.
Boundary markers: None identified; user content is processed alongside instructions.
Capability inventory: The skill has the capability to execute shell commands via python3 to interact with TTS scripts.
Sanitization: There is no mention of sanitizing or escaping the transcribed text before it is used in logic or commands.
[COMMAND_EXECUTION]: The skill instructs the agent to execute shell commands using environment-defined variables $MCP_CALL and $TTS_MCP_SCRIPT. The text to be synthesized is embedded into a JSON payload wrapped in single quotes: python3 $MCP_CALL "..." text_to_speech '{"text":"[CONTENT]",...}'. If the content generated by the agent (which may include data from user transcripts) contains single quotes, it could lead to shell breakout or command injection.

slack-voice-interface