The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from various external sources (Slack exports, email threads, call transcripts, and CRM data) to populate the knowledge base. This ingested content is later used as context for AI queries and wiki compilation, creating a surface for indirect prompt injection.
Ingestion points: Data enters the system via the raw/, meetings/, people/, and companies/ directories from external automations or manual pastes.
Boundary markers: While the skill uses metadata frontmatter and markdown headers (e.g., ## Sources), it lacks specific structural delimiters or instructions to treat external content as untrusted data rather than agent instructions.
Capability inventory: The skill utilizes file system read/write access, Git operations, and shell command execution.
Sanitization: There is no evidence of content sanitization or filtering to remove potential injection patterns from the ingested data.
[COMMAND_EXECUTION]: The skill requires the agent to execute shell commands to maintain the vault and generate outputs. These include Git operations (git pull --rebase --autostash, git commit, git push) and document conversion using pandoc with the xelatex engine.
[DATA_EXFILTRATION]: The architecture is designed to synchronize sensitive company information (such as internal decisions, contact biographies, and sales objections) with remote Git repositories (e.g., GitHub or GitLab). While this is the intended workflow for a shared brain, it establishes a network path for sensitive data egress.

company-brain