The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from external sources that could contain adversarial instructions.
Ingestion points: Raw financial data (bank transactions, payment processor events, payroll records) is pulled from external APIs and saved as JSONL files as described in Phase 1 of the monthly workflow.
Boundary markers: The instructions lack specific delimiters or isolation techniques to prevent the agent from following instructions embedded within transaction notes or contractor metadata during the reconciliation phases.
Capability inventory: The agent has access to shell commands (git, gh, mkdir) and file write capabilities which could be targeted by a successful injection attack.
Sanitization: The instructions do not specify sanitization or validation of external transaction data before it is processed by the agent.
[DATA_EXFILTRATION]: The skill manages highly sensitive financial information, including transaction history, payroll details, and partner distribution amounts.
The skill accesses potentially sensitive information in global memory paths and local financial data repositories.
It implements security best practices by providing a .gitignore template and strict instructions for targeted git operations to prevent the accidental commitment of raw financial data to remote repositories.
[COMMAND_EXECUTION]: The skill relies on various CLI tools (e.g., git, gh, and financial platform CLIs) to retrieve data and manage reporting workflows. These operations are performed in a high-privilege context relative to the sensitive data being handled, though they are core to the skill's intended functionality.

company-cfo