The Agent Skills Directory

[COMMAND_EXECUTION]: The skill uses shell commands via npx to interact with the ClawLink CLI. This includes authentication (login, connect) and data operations (actions, run).
[EXTERNAL_DOWNLOADS]: The skill fetches the @useclawlink/cli package from the NPM registry when the agent executes the integration commands. This is a standard operation for this vendor's integration tools.
[INDIRECT_PROMPT_INJECTION]: The skill processes data from SharePoint lists and files, which could contain malicious instructions designed to influence the agent's behavior. The skill includes a mitigation strategy by instructing the agent to read data first and seek explicit human approval before performing any write actions or permission changes.
Ingestion points: Data retrieved from SharePoint lists, attachments, and drive items via the run command.
Boundary markers: The instructions explicitly state "confirm with the user before any write" and require "explicit human approval" for permission changes.
Capability inventory: The skill can execute shell commands (npx), write to SharePoint, and modify access control lists (ACLs).
Sanitization: The skill relies on the agent's internal safety filters and user verification rather than programmatic sanitization of the SharePoint content.

sharepoint