The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill's primary function is to ingest and process raw human input from external sources like transcripts and emails, which are potentially untrusted. This creates a vulnerability where malicious instructions embedded in the input could attempt to manipulate the agent's behavior.
Ingestion points: The skill reads data from the user's prompt, the system clipboard (using pbpaste), and local transcript files.
Boundary markers: There are no specific instructions or delimiters provided to help the agent isolate the untrusted input from the skill's logic.
Capability inventory: The agent can create and search GitHub issues (gh), write files to a local vault, and interact with the keep CLI.
Sanitization: The skill lacks explicit sanitization steps for the external content it processes.
[COMMAND_EXECUTION]: The skill utilizes several command-line tools to perform its actions. This includes pbpaste for reading clipboard data and the gh (GitHub CLI) for issue management. It also references an optional keep CLI. These tools are used appropriately for the skill's stated purpose but involve executing commands based on interpreted data.
[DATA_EXPOSURE_AND_EXFILTRATION]: The skill accesses sensitive local information, specifically the system clipboard and a private configuration file (people.yaml) stored in the user's home directory. This file contains private routing information and repository names. While necessary for the skill's operation, this access exposes sensitive data to the agent's context.

ingest