The Agent Skills Directory

[PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection due to its design for processing external event data.
Ingestion points: Event payloads from the internal event bus (e.g., calendar.booking.created, mail.*) serve as data sources.
Boundary markers: The documentation lacks mention of delimiters or instructions to isolate the event payload from the automation's primary instructions, allowing data to be interpreted as commands.
Capability inventory: The automation's agent loop can invoke any registered actions and perform outbound HTTP requests using the web-request tool.
Sanitization: No sanitization, escaping, or filtering of event payload content is described before the data enters the agent's context.
[PROMPT_INJECTION]: The skill implements 'agentic' automations where natural-language instructions stored in jobs/*.md files are executed by an agent. If an attacker can influence the creation or update of these files (e.g., via the define or update actions), they can inject malicious instructions that the agent will follow during the next trigger event.
[DATA_EXFILTRATION]: The web-request tool provides a mechanism for outbound HTTP communication. While it incorporates security features such as server-side secret substitution (${keys.NAME}) and origin-level allowlists, it serves as a potential exfiltration vector if the agent's execution logic is subverted.
[COMMAND_EXECUTION]: The system allows for persistence and recurring execution by storing automation logic in markdown files within the jobs/ directory. These files are executed automatically based on cron schedules or event triggers, which could be abused to maintain long-term access or perform repeated unauthorized actions if the file content is compromised.

automations