The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is designed to process untrusted "raw human input" like meeting transcripts and forwarded messages, which serves as a significant vector for indirect prompt injection.
Ingestion points: Ingests untrusted data through prompt text and the pbpaste command as described in SKILL.md.
Boundary markers: The instructions include safety constraints such as drafting rather than sending replies and requiring user confirmation for sensitive items like credentials or legal commitments.
Capability inventory: The skill possesses the ability to create GitHub issues via the gh CLI, write to a local vault directory, and modify the people.yaml configuration file.
Sanitization: The skill performs name spelling verification against a known config but lacks explicit sanitization or escaping of the raw input before it is used to generate GitHub issues or file contents.
[COMMAND_EXECUTION]: Utilizes multiple shell-based tools to interact with the system and external services.
Evidence: Executes pbpaste to access clipboard data, gh issue list and gh issue create to manage GitHub tasks, and potentially uses the keep CLI for note management.
[DATA_EXFILTRATION]: Accesses and stores data in sensitive local directories and configuration files.
Evidence: Reads and updates routing configuration in ${HOME}/.config/makerskills/ingest/people.yaml and writes extracted decisions and facts to a local vault in ${HOME}/Documents/SecondBrain.

ingest