The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is designed to process and synthesize data from untrusted external sources, including chat messages, emails, and cloud storage files. This creates a vulnerability surface for indirect prompt injection, where an attacker could embed malicious instructions in those sources to manipulate the agent's output or actions.
Ingestion points: The workflow in SKILL.md ingests raw results from diverse external sources (labeled as ~~chat, ~~email, ~~cloud storage, and ~~project tracker).
Boundary markers: The skill uses simple text markers (e.g., ~~chat result:) to prefix external data, which provides minimal structural isolation and does not prevent the agent from interpreting instructions contained within that data.
Capability inventory: The skill is configured with access to read_file and run_shell_command tools, which increases the potential risk if the agent were to follow instructions injected via external data.
Sanitization: The instructions focus on deduplication and confidence scoring but do not provide specific directives to sanitize, escape, or disregard executable instructions or system-like commands found within the source content.

knowledge-synthesis