The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes external data from teammates (via Slack intake) to populate email subjects and bodies. This creates a surface where a teammate could provide malicious instructions intended to influence the agent when the owner later reviews or sends the draft.
Ingestion points: Slack intake and email draft parameters in queue-email-draft.
Boundary markers: The instructions do not explicitly specify delimiters for untrusted content, though it relies on standard agent context handling.
Capability inventory: Ability to send emails (send-queued-drafts) and update database state (update-queued-draft).
Sanitization: The skill mitigates this risk by enforcing that drafts are for review, requiring the draft owner's explicit action to send, and maintaining a 'standard approval gate' for each email sent.
[COMMAND_EXECUTION]: The skill mentions internal file paths such as server/lib/queued-drafts.ts and SQL table names like queued_email_drafts, but these are used for architectural context and do not involve arbitrary command execution or shell access.
[DATA_EXFILTRATION]: The skill accesses organizational member emails via list-org-members and Slack users.info. This is necessary for its primary purpose of managing drafts within an organization. It enforces organization-level membership checks to prevent unauthorized access to this data.

draft-queue