The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill instructions (e.g., in examples/faq-answers.md and examples/3p-updates.md) direct the agent to ingest data from untrusted or external sources like Slack posts, emails, and shared documents. This creates a surface where malicious instructions could be embedded in corporate data to influence the agent's output or behavior.
Ingestion points: The skill explicitly instructs the agent to use tools to read from Slack, Google Drive, Email, and Calendar across multiple instruction files.
Boundary markers: There are no explicit instructions or delimiters provided to the agent to treat information from these sources as data only and to ignore any embedded instructions (e.g., 'Ignore previous instructions' hidden in a Slack message).
Capability inventory: The skill primarily uses read operations on sensitive communication tools and write operations (drafting responses) back to the user or Slack/Email contexts.
Sanitization: The skill lacks sanitization steps or filtering logic for the external content it aggregates.

internal-comms