The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is designed to process content from various untrusted external platforms, creating a significant surface for indirect prompt injection attacks.
Ingestion points: Several instruction files (examples/3p-updates.md, examples/company-newsletter.md, examples/faq-answers.md) direct the agent to retrieve and summarize data from Slack, Google Drive, Email, and Calendar.
Boundary markers: The instructions lack delimiters or explicit warnings to the agent to treat the retrieved content as data rather than instructions, which could allow malicious embedded commands to be executed.
Capability inventory: The skill utilizes tools to read from internal messaging and document storage services. If the agent is compromised by injected instructions, these read capabilities (and any associated write capabilities) could be misused.
Sanitization: No mechanisms are defined to sanitize or filter the data fetched from these external tools before it is processed by the LLM.
[DATA_EXFILTRATION]: The skill encourages the agent to access and aggregate sensitive corporate data, increasing the risk of unauthorized exposure.
Sensitive access: The agent is instructed to search for and summarize communications from executives and leadership, as well as high-level vision and strategy documents.
Exposure risk: By bringing sensitive corporate intelligence into the active context, the skill increases the potential impact of a data breach or session hijacking.

internal-comms