The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection because it processes data generated by external users which could contain malicious prompts.
Ingestion points: Untrusted external content is ingested via get_workitem_brief and search_by_mql in references/work-items.md, as well as list_workitem_comments in references/activity.md.
Boundary markers: Absent. There are no guidelines or encapsulation mechanisms (like XML tags or backticks with warnings) instructing the model to ignore potential instructions embedded within the fetched fields or comments.
Capability inventory: The skill lists extensive write capabilities in references/tool-reference.md, including create_workitem, update_field, add_comment, and state/node transition tools.
Sanitization: Absent. The fetched content is formatted directly into markdown tables or structured sections without validation or escaping.

feishu-projects